Time4Popcorn Updater RCE: How Eye Security Remotely Disabled 2 Million Endpoints — Detection & Hardening Guide

---
title: Time4Popcorn Updater Process Execution
id: 8f3a2b1c-9d4e-4f5a-b6c7-8d9e0f1a2b3c
status: experimental
description: Detects execution of the Time4Popcorn background updater process, which is a known abandoned software component with remote code execution risk.
references:
  - https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\Time4Popcorn.exe'
      - '\PopcornTime.exe'
      - '\Updater.exe'
  selection_cli:
    CommandLine|contains:
      - 'Time4Popcorn'
      - 'Popcorn Time'
  condition: selection_img or selection_cli
falsepositives:
  - Legitimate installations of actively maintained Popcorn Time forks (rare in enterprise environments)
level: high
---
title: Time4Popcorn Updater Network Beaconing
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network connections to known Time4Popcorn update domains or patterns consistent with the updater's polling behavior.
references:
  - https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'time4popcorn'
      - 'popcorntime'
      - 'popcorn-time'
    Initiated: 'true'
falsepositives:
  - Security research or honeypot activity
  - DNS queries from passive DNS replication
level: medium
---
title: Suspicious Temporary Executable from Updater Directory
id: 9c8b7a6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects execution of unsigned binaries from temporary directories commonly used by the Time4Popcorn updater for payload staging.
references:
  - https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|startswith:
      - 'C:\Users\*\AppData\Local\Temp\'
      - 'C:\Windows\Temp\'
    Image|endswith: '.exe'
  filter_signed:
    SignatureStatus: 'valid'
  condition: selection and not filter_signed
falsepositives:
  - Legitimate software installers or IT automation tools running from temp paths
level: medium

// Hunt for Time4Popcorn process execution and network connections
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName has_any ("Time4Popcorn.exe", "PopcornTime.exe", "Updater.exe")
   or ProcessCommandLine has_any ("Time4Popcorn", "Popcorn Time")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessAccountName
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any ("time4popcorn", "popcorntime", "popcorn-time")
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
) on DeviceName
| extend Suspicious = iif(isnotempty(RemoteUrl), "Yes", "No")
| where Suspicious == "Yes" or isnotempty(FileName)
| summarize by DeviceName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP

// Identify unsigned executables launching from temp directories (common updater staging)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FolderPath startswith @"C:\Users\" and FolderPath contains @"\AppData\Local\Temp\"
   and FileName endswith ".exe"
| extend IsSigned = todynamic(FileOriginInfo).IsSigned
| where IsSigned == false or IsSigned == "False"
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| summarize ExecutionCount = count(), LastSeen = max(TimeGenerated) by DeviceName, FileName, SHA256
| order by LastSeen desc

-- Hunt for Time4Popcorn processes and related temp executables
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)time4popcorn|popcorntime'
   OR Exe =~ '(?i)time4popcorn|popcorntime'
   OR CommandLine =~ '(?i)time4popcorn|popcorn time'

-- Identify recently created executables in user temp directories
SELECT FullPath, Size, Created, Modified
FROM glob(globs='C:\\Users\\*\\AppData\\Local\\Temp\\*.exe')
WHERE Created > now() - 86400 * 7
ORDER BY Modified DESC

# Time4Popcorn Remediation Script - Security Arsenal
# Run as Administrator

$ErrorActionPreference = "SilentlyContinue"
$LogPath = "$env:SystemDrive\ProgramData\SecurityArsenal\Time4Popcorn_Remediation.log"
New-Item -ItemType Directory -Path (Split-Path $LogPath) -Force | Out-Null
Start-Transcript -Path $LogPath -Append

Write-Host "[+] Starting Time4Popcorn detection and remediation..." -ForegroundColor Cyan

# 1. Kill running processes
$Processes = Get-Process | Where-Object { $_.Name -match 'time4popcorn|popcorntime' -or $_.Path -match 'time4popcorn|popcorntime' }
if ($Processes) {
    Write-Host "[-] Found running processes:" -ForegroundColor Yellow
    $Processes | Select-Object Name, Id, Path | Format-Table
    $Processes | Stop-Process -Force
    Write-Host "[+] Terminated $($Processes.Count) process(es)." -ForegroundColor Green
} else {
    Write-Host "[+] No running Time4Popcorn processes detected." -ForegroundColor Green
}

# 2. Remove scheduled tasks
$Tasks = Get-ScheduledTask | Where-Object { $_.TaskName -match 'popcorn|time4popcorn' -or $_.Actions.Execute -match 'time4popcorn|popcorntime' }
if ($Tasks) {
    Write-Host "[-] Found scheduled tasks:" -ForegroundColor Yellow
    $Tasks | Select-Object TaskName, TaskPath | Format-Table
    $Tasks | Unregister-ScheduledTask -Confirm:$false
    Write-Host "[+] Removed $($Tasks.Count) scheduled task(s)." -ForegroundColor Green
} else {
    Write-Host "[+] No related scheduled tasks found." -ForegroundColor Green
}

# 3. Identify and quarantine installation directories
$SearchPaths = @(
    "$env:ProgramFiles",
    "$env:ProgramFiles(x86)",
    "$env:LOCALAPPDATA",
    "$env:APPDATA"
)

$FoundDirs = @()
foreach ($Path in $SearchPaths) {
    $Dirs = Get-ChildItem -Path $Path -Directory -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'time4popcorn|popcorntime' }
    $FoundDirs += $Dirs
}

if ($FoundDirs) {
    $Quarantine = "$env:SystemDrive\ProgramData\SecurityArsenal\Quarantine"
    New-Item -ItemType Directory -Path $Quarantine -Force | Out-Null
    foreach ($Dir in $FoundDirs) {
        $Dest = Join-Path $Quarantine ($Dir.Name + "_" + (Get-Date -Format 'yyyyMMdd_HHmmss'))
        Write-Host "[-] Quarantining $($Dir.FullName) to $Dest" -ForegroundColor Yellow
        Move-Item -Path $Dir.FullName -Destination $Dest -Force
    }
    Write-Host "[+] Quarantined $($FoundDirs.Count) directory(ies)." -ForegroundColor Green
} else {
    Write-Host "[+] No Time4Popcorn installation directories found." -ForegroundColor Green
}

# 4. Check for updater persistence in registry
$RegPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($RegPath in $RegPaths) {
    $Props = Get-ItemProperty -Path $RegPath -ErrorAction SilentlyContinue
    if ($Props) {
        $Props.PSObject.Properties | Where-Object { $_.Value -match 'time4popcorn|popcorntime' } | ForEach-Object {
            Write-Host "[-] Removing registry persistence: $($_.Name) = $($_.Value)" -ForegroundColor Yellow
            Remove-ItemProperty -Path $RegPath -Name $_.Name -Force
        }
    }
}

Write-Host "[+] Remediation complete. Review log at $LogPath" -ForegroundColor Cyan
Stop-Transcript