Italian authorities have dismantled a piracy ecosystem centered around the CINEMAGOAL app that provided access to various streaming platforms, including Netflix, Disney+, and Spotify.
Unlike typical IPTV service providers that openly market themselves online and expose their operations, CINEMAGOAL’s approach was stealthier, as it used an app that customers installed on their devices.
During the large-scale anti-piracy operation called “Tutto Chiaro” (All Clear), Italian law enforcement conducted 100 searches across the country and seized materials that could help investigators identify involved individuals, as well as determine the amount of illegal profits.
According to Guardia di Finanza, the law enforcement agency operating under the Ministry of Economy and Finance, the operators of CINEMAGOAL likely made millions of euros from audiovisual piracy, unauthorized computer access, and computer fraud.
The CINEMAGOAL app connected directly to the legitimate streaming platforms and authenticated using valid decryption codes fetched from foreign servers.
The system used virtual machines in Italy to capture valid authentication/decryption codes from legitimate subscriptions every 3 minutes and redistribute them to customers. These legitimate subscriptions were opened using false identification data on Sky, DAZN, Netflix, Disney+, and Spotify.
Authorities highlight that CINEMAGOAL not only evaded blocks but also offered superior streaming quality, as users streamed content directly from the service rather than receiving a pirate stream, and masked customers’ real IP addresses.
“A highly advanced and previously unseen system that not only bypassed the security blocks implemented by the platforms, but also increased viewing quality, reducing the possibility that end users could be ‘intercepted’” by the control system,” Guardia di Finanza explains.
“Access to the aforementioned application, in fact, did not involve the use of a connection directly attributable to a specific IP address, thereby providing greater shielding for the end user.”
In an action coordinated by Eurojust, police forces seized CINEMAGOAL servers in France and Germany that contained the app’s source code and functions for decoding protected streams. 200 financial police officers participated in the operation.
The illegal streaming business had more than 70 resellers, who sold annual subscriptions between €40 and €130 ($46-$150).
Payments were made using cryptocurrency or to foreign bank accounts and accounts registered under fake names.
It is estimated that CINEMAGOAL has caused damages of around €300 million ($347M) in unpaid subscription revenues over the time of its operation.
Authorities are now analyzing seized material to identify all involved parties, including end users, and estimate total profits.
They have already identified many subscribers and sent penalties ranging from €154 to €5,000 ($179-$5,800) to the first 1,000 of them.
The investigation into CINEMAGOAL is still in a preliminary phase, as specified by Guardia di Finanza.
During the same law enforcement action, an IPTV service known as “pezzotto” was also identified and dismantled.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Bill Toulas
Read More