{"id":2148,"date":"2026-10-25T07:19:33","date_gmt":"2026-10-25T00:19:33","guid":{"rendered":"https:\/\/vncybers.vn\/hieu-operation-ixim-trinh-cap-nhat-popcorn-time-botnet\/"},"modified":"2026-10-25T07:19:33","modified_gmt":"2026-10-25T00:19:33","slug":"operation-ixim-abandoned-popcorn-time-updater-botnet","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/hieu-operation-ixim-trinh-cap-nhat-popcorn-time-botnet\/","title":{"rendered":"Understanding Operation IXIM: How an Abandoned Updater Could Turn Millions of Computers into a Botnet"},"content":{"rendered":"

An apparently forgotten application can quietly retain administrative privileges on millions of computers. Eye Research's Operation IXIM found that the Time4Popcorn updater continued contacting an expired domain, downloading files over unencrypted HTTP, and executing them as SYSTEM on Windows or root on macOS. The vulnerability is tracked as CVE-2026-30612.<\/p>\n

\"Map
Time4Popcorn connections observed worldwide by Eye Research. Source: Eye Research.<\/figcaption><\/figure>\n

Where Is the Weakness?<\/h2>\n

Time4Popcorn l\u00e0 m\u1ed9t nh\u00e1nh kh\u00f4ng ch\u00ednh th\u1ee9c c\u1ee7a Popcorn Time, ph\u1ea7n m\u1ec1m k\u1ebft h\u1ee3p giao di\u1ec7n xem phim v\u1edbi BitTorrent. D\u00f9 d\u1ef1 \u00e1n \u0111\u00e3 ng\u1eebng ho\u1ea1t \u0111\u1ed9ng, m\u1ed9t d\u1ecbch v\u1ee5 n\u1ec1n v\u1eabn \u0111\u1ecbnh k\u1ef3 h\u1ecfi t\u00ean mi\u1ec1n popcorntimeupd.xyz<\/code> xem c\u00f3 b\u1ea3n c\u1eadp nh\u1eadt m\u1edbi hay kh\u00f4ng. \u1ee8ng d\u1ee5ng kh\u00f4ng d\u00f9ng HTTPS v\u00e0 c\u0169ng kh\u00f4ng x\u00e1c minh ch\u1eef k\u00fd s\u1ed1 c\u1ee7a t\u1ec7p th\u1ef1c thi tr\u01b0\u1edbc khi ch\u1ea1y.<\/p>\n

This created a dangerous trust chain: anyone controlling the domain or intercepting the HTTP traffic could deliver an arbitrary file. Because the updater ran with elevated privileges, delivered code could take over the entire system without the user opening the application.<\/p>\n

From an Expired Domain to Botnet Risk<\/h2>\n

Eye Research registered the abandoned update domain and began observing traffic. The team recorded up to roughly 3 million Windows connections and 350,000 macOS connections. Requests came not only from residential networks but also from businesses, government agencies, and military networks.<\/p>\n

The devices did not appear to be actively using Time4Popcorn; the software had simply been forgotten. This is the risk of zombie software: its interface may never be opened again, while background services, scheduled tasks, and elevated privileges remain for years.<\/p>\n

What Did Operation IXIM Do?<\/h2>\n

From November 2025 to March 2026, Eye Research used the vulnerable update mechanism itself to distribute a remediation package. The code stopped and disabled the updater, collected no host data, sent no telemetry, and deleted no user files. The team said it sought legal advice before deployment.<\/p>\n

More than 2 million remediation downloads were recorded. By March 1, 2026, requests to the update domain had fallen by 98%. After the operation, the related domains were transferred to the Shadowserver Foundation, a nonprofit that tracks and helps neutralize malicious infrastructure.<\/p>\n

Why Is This Approach Controversial?<\/h2>\n

Technically, the researchers executed code on computers they did not own. The intent was defensive and the payload was deliberately minimal, but the method still raises questions about consent, authority, and liability if remediation causes a failure.<\/p>\n

IXIM exposes a difficult gap: the vendor no longer exists, users do not know a dangerous service remains on their computers, and criminals could register the abandoned infrastructure at any time. Any active intervention requires legal controls, strict data limits, safety testing, and a transparent handover process.<\/p>\n

The Risk Has Not Completely Disappeared<\/h2>\n

Eye Research could not automatically disable the Android updater because the operating system requires user interaction to install a new package. Remaining mobile copies of Time4Popcorn therefore need to be removed manually.<\/p>\n

Beyond CVE-2026-30612, the application embeds a Chromium version from 2014 and lacks modern sandboxing. Even with the updater disabled, keeping the software adds attack surface. The safest recommendation is to remove Time4Popcorn and any unsupported Popcorn Time forks completely.<\/p>\n

Software Supply Chain Lessons<\/h2>\n

The incident shows that control of software updates matters as much as the source code itself. Domains, certificates, signing keys, and release servers all need an end-of-life plan. If a product shuts down and these assets simply expire, update control can pass to the next registrant.<\/p>\n

HTTPS protects the transport channel but cannot replace digital signatures. A secure updater must verify signatures with a trusted key pinned in the application, reject incorrectly signed packages, support key revocation, and reduce the updater's privileges to the minimum required.<\/p>\n

What Should Users and Organizations Check?<\/h2>\n
    \n
  • Remove Time4Popcorn, Popcorn Time builds from unknown sources, and any software no longer supported by its vendor.<\/li>\n
  • Review background services, startup tasks, and old software with asset-management tools instead of relying only on the applications users regularly open.<\/li>\n
  • Ki\u1ec3m tra l\u1ecbch s\u1eed k\u1ebft n\u1ed1i t\u1edbi popcorntimeupd.xyz<\/code> v\u00e0 c\u00e1c t\u00ean mi\u1ec1n c\u1eadp nh\u1eadt li\u00ean quan \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh ph\u1ea1m vi thi\u1ebft b\u1ecb t\u1eebng c\u00e0i \u0111\u1eb7t.<\/li>\n
  • If a device ran Time4Popcorn, perform a full scan and consider rebuilding it when system integrity cannot be verified.<\/li>\n
  • Developers should require signed update packages, verify signatures independently of HTTPS, and create an end-of-life process for domains and signing keys.<\/li>\n<\/ul>\n

    Conclusion<\/h2>\n

    Operation IXIM is a rare example of a broken update mechanism being used to disable itself before becoming attack infrastructure. The operation sharply reduced the number of connecting machines, while showing that forgotten software can retain elevated privileges and continue receiving commands from the internet.<\/p>\n

    The core lesson goes beyond patching CVE-2026-30612. Users must remove end-of-life software, while developers must design both update and product-retirement processes as part of the security model.<\/p>\n

    VNCyberS<\/strong> compiled from Eye Research and BleepingComputer<\/em><\/p>","protected":false},"excerpt":{"rendered":"

    M\u1ed9t \u1ee9ng d\u1ee5ng t\u01b0\u1edfng nh\u01b0 \u0111\u00e3 b\u1ecb l\u00e3ng qu\u00ean v\u1eabn c\u00f3 th\u1ec3 \u00e2m th\u1ea7m duy tr\u00ec quy\u1ec1n qu\u1ea3n tr\u1ecb tr\u00ean h\u00e0ng tri\u1ec7u m\u00e1y t\u00ednh. Operation IXIM c\u1ee7a Eye Research cho th\u1ea5y tr\u00ecnh c\u1eadp nh\u1eadt Time4Popcorn ti\u1ebfp t\u1ee5c k\u1ebft n\u1ed1i t\u1edbi m\u1ed9t t\u00ean mi\u1ec1n h\u1ebft h\u1ea1n, t\u1ea3i t\u1ec7p qua HTTP kh\u00f4ng m\u00e3 h\u00f3a v\u00e0 ch\u1ea1y n\u1ed9i […]<\/p>\n","protected":false},"author":2,"featured_media":2147,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[149,1012,1009,1013,1011,22,1010],"class_list":["post-2148","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-botnet","tag-cve-2026-30612","tag-operation-ixim","tag-phan-mem-het-vong-doi","tag-popcorn-time","tag-supply-chain","tag-time4popcorn"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2148"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2148\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2147"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}