The original post: /r/usenet by /u/Bladder-Splatter on 2024-09-28 14:52:07.

This will be a little hard with rule 1 as I cannot even call out the 2 groups I’ve seen do this exact thing recently. (Looking I don’t see anything about indexers, so I can say it’s on Su, and is still on Su.)

For actual meat of this question/discovery I found “media” grabbed by Sonarr to twice this week be a strange ploy. Nothing as obvious as a small exe file, but rather a very strange lnk file with its icon changed to resemble media. The file then directs a shit ton of script operations to system32 including a “Hi!” that I was not willing to keep on my system to discover the full effect of.

These files are worrying mostly because they resemble normal media and one might open them without noticing the small arrow icon, that they’re seen as real releases in sections I honestly have never had virus attempts before (0day is where this cancer usually sits) and they’re roughly 1GB which is certainly a common size for genuine media.

Has anyone else encountered this suddenly spiking? I’ve never had it before. I’d like to name the “groups” doing it but won’t do so unless I get mod approval given how strict rule 1 is.