Ransomware Hits TV Guide Magazine by Play Group Attack
Ransomware Attack on TV Guide Magazine by Play Group
TV Guide Magazine, a prominent American biweekly publication, has recently been targeted by the Play ransomware group. This attack underscores the persistent threat ransomware poses to media organizations, highlighting vulnerabilities within the industry.
About TV Guide Magazine
Founded in 1948, TV Guide Magazine is a well-established publication known for its comprehensive television program listings and entertainment news. Owned by NTVB Media since 2015, the magazine operates under TV Guide Magazine LLC and is based in New York City. With a circulation of approximately 1.1 million copies, it serves as a trusted resource for television programming and entertainment information. The magazine employs between 51 and 200 staff members, focusing on delivering detailed program listings, celebrity interviews, and entertainment news.
Vulnerabilities and Targeting
Media organizations like TV Guide Magazine are attractive targets for ransomware groups due to their reliance on digital platforms and the sensitive nature of their data. The magazine's digital presence, which mirrors its print content, makes it susceptible to cyber threats. The Play ransomware group, known for exploiting vulnerabilities in RDP servers, FortiOS, and Microsoft Exchange, could have leveraged these weaknesses to infiltrate TV Guide Magazine's systems.
Attack Overview
The Play ransomware group, active since June 2022, has claimed responsibility for the attack on TV Guide Magazine. This group has a history of targeting diverse industries, including media, by exploiting network vulnerabilities and using tools like Mimikatz for privilege escalation. The attack on TV Guide Magazine disrupted its operations, emphasizing the need for effective cybersecurity measures to protect against such threats.
About the Play Ransomware Group
Play ransomware, also known as PlayCrypt, distinguishes itself by not including an initial ransom demand in its notes, directing victims to contact them via email instead. The group has impacted over 300 entities globally, using custom tools and techniques to evade detection and maintain persistence. Their dark web presence allows them to publicize attacks and pressure victims into compliance.
Potential Penetration Methods
The Play group likely penetrated TV Guide Magazine's systems through known vulnerabilities in RDP servers or Microsoft Exchange, exploiting weak points in network security. Their use of tools like PsExec and scheduled tasks for execution and persistence further facilitated the attack, allowing them to maintain control over compromised systems.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!