[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fo6GomdcIzBWovzBHn5k1pP57rqsAMWWJCHCkQK-JF-0":3},{"article":4,"iocs":39},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"18cc4a76-bb9a-4821-ae9c-ecb2e156884c","The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents","the-odyssey-and-trojans-again-moviereaper-attacks-users-in-multiple-countries-vi-9e0dd1","Kaspersky experts have discovered a new MovieReaper campaign. The multi-stage Trojan spreads through movie torrents, such as \"The Odyssey,\" and uses the Solana blockchain to hide its C2 infrastructure.","Kaspersky has uncovered a new MovieReaper campaign where a multi-stage Trojan is distributed through compromised torrent files, disguised as popular movies like 'The Odyssey.' The malware leverages the Solana blockchain for its command and control (C2) infrastructure, making it harder to track. The campaign has affected hundreds of victims globally, including both individuals and organizations.","MovieReaper campaign uses compromised torrents to distribute multi-stage Trojan with Solana C2 infrastructure.","Table of Contents IntroductionTechnical DetailsBackgroundInitial infection and spreadingMalware implantsStep 1: LoaderStep 2: ShellcodeStep 3: UAC Bypass and persistenceStep 4: The final implantInfrastructureVictimsConclusionsIndicators of compromiseFile hashesFile pathsMutexesDomains and IPs Authors Konstantin Isakov Pavel Cheremushkin Introduction Torrent trackers have long been abused for distributing malicious software, disguised as popular films, games, and other content. Our previous research has shown that cybercriminals repeatedly turn torrents as an initial infection vector, using trojanized cracks and installers to reach a large number of users. Installation guides for pirated software routinely instruct users to disable their antivirus, conditioning them to ignore potential threats they are inviting onto their computers. During our analysis of malware that leverages blockchain networks for its C2 infrastructure, we have discovered a previously unknown modular, multi-stage framework that we dubbed MovieReaper. This report details the new crimeware campaign that began with the mass infection of users via compromised torrent tracker file storage. We have identified several hundred victims, including both individual users and organizations in a multitude of countries, such as Russia, Türkiye, Japan, Kenya, Uganda, and Colombia, as well as in several European countries like Spain, the Netherlands, Belgium, Germany. We analyze the techniques used to evade detection by security and sandbox solutions, examine the capabilities of the modular framework. Kaspersky products detect this threat as HEUR:Trojan.Win64.Agent.gen. Technical Details Background In mid‑August 2026, during our threat‑hunting efforts, we identified a large‑scale infection campaign involving previously unknown malware disguised as popular movies. The campaign affected both individuals and organizations across multiple countries. Our initial analysis revealed a common factor among the victims: all had used torrent trackers. This finding prompted us to investigate the campaign further and analyze its distribution mechanism, overall scope, and unknown malware implants. Initial infection and spreading Compromised torrent trackers are the primary vector used to distribute malware. During our investigation, we identified multiple user reports describing suspicious files being downloaded instead of the intended content. For example, a user of a popular movie torrent tracker reported the following case on Reddit: Further analysis of the attack revealed that the threat actors did not compromise the torrent trackers themselves. Instead, they compromised a widely used public repository of torrent files — itorrents[.]org. As a result, torrent trackers that relied on this repository began inadvertently distributing malicious torrent files to their users. This approach is particularly powerful because the threat actors can reach users of multiple tracчkers without compromising each platform individually. As of the publication date of this report, the archive remains compromised. When a user attempts to download a torrent using a magnet link, the legitimate torrent archive instead returns a different torrent file. This malicious torrent leads to the download of the malware loader. It is used to deploy a framework that we dubbed MovieReaper. The loader initiates the infection chain, which is illustrated in the diagram below. Each stage of the infection chain is described in detail in the following sections. Malware implants The infection chain consists of several steps, where only the initial one is dropped on the disk before its execution to avoid detection. The malware itself is not heavily obfuscated, apart from the fact that strings are encrypted with a custom stream cipher. Most of the countermeasures were aimed at avoiding detection by AV sandboxes. Step 1: Loader The most popular initial executable was distributed through torrent trackers under many different names (for example, the odyssey (2026) [1080p] [webrip] [5.1].exe), but the file hash (MD5: A0B13781EDD7CFDAB13D79AFFF3C83C1) was identical across all downloads. We have seen multiple different loaders, where the executable file disguises itself with a long filename and an icon of some well-known application. Most of the filenames are rather large, presumably, to hide the “.exe” extension at the end. After the user manually starts the application, it establishes a global mutex to ensure that only one loader is executed at a time. We have seen several variations of a mutex in our samples, which contain a randomly generated string (in example Global\\fnulSktzSqvVLXHU). Then this executable performs the series of operations in order to avoid detection by the AV sandbox solutions. While performing those operations, the malware avoids making LoadLibrary and GetProcAddress calls in order to acquire addresses of required functions. Instead, it searches for loaded libraries by traversing the double-linked list taken from the Ldr field of PEB and then performs manual parsing of loaded DLL to calculate the address of function. After all the initial checks have passed, this binary prepares to perform network connection to a C2 web-server to download the shellcode, map it into the RWX memory and execute. While doing it, loader decodes https:\u002F\u002Fdeadhub[.]org domain name and if connection to it has failed, then it uses the IP address http:\u002F\u002F193.23.118[.]155 as a fallback and connects to it using plain HTTP. Malware chooses a random group of strings and uses them as a path in the HTTP request to download parts of a shellcode. Example URLs: \u002Fcloud\u002Fv192.4\u002Fui\u002Fsync-status-icons.png \u002Fcloud\u002Fv192.4\u002Fonboarding\u002Fwelcome-bg.jpg \u002Fcloud\u002Fv192.4\u002Fui\u002Ffile-preview-placeholder.png \u002Fcloud\u002Fv192.4\u002Fshared\u002Flink-banner.jpg While mapping the address space and executing the shellcode, the loader registers a vectored exception handler and rewrites the handler address in memory in order to perform a debug break, which will not crash the program, but instead redirect control-flow into the function that actually makes raw NtProtectVirtualMemory syscall (via previously located “0x0F 0x05” syscall instruction inside ntdll). Then it calls an undocumented ntdll function EtwpCreateEtwThread, which is a popular alternative to a CreateThread to perform code execution and executes the shellcode. Step 2: Shellcode The second stage of this malware performs an HTTPS request to the Solana blockchain at the \u002FgetAccountInfo endpoint for the 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm account. The data field of the response contains the base64‑encoded address of a second C2, which is encrypted with a static XOR key located within the shellcode itself. To store data in this account, attackers used a simple Solana program (address: CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL). By using Solana blockchain network as a distribution layer of endpoints for a next stage attackers may increase stability of their campaign and resist takedown efforts of defenders. The second stage payload communicates with its C2 server strictly through HTTPS via TLS-pinned certificate using nanopb protobuf library as a container for transferred data. The main logic of stage 2 implant contains several initial commands, where the most important is the one that parses the COFF file and loads it to the memory, and executes the module_init function from it. It provides a convenient interface for extension of the command list, which leads us to the next stage of the payload. Step 3: UAC Bypass and persistence Notably, the recovered modules were compiled with symbols, which accelerated reverse engineering. After receiving the next stage from the second C2 server, the newly loaded module performs several tasks right in the module_init function. Stage 3 performs UAC Bypass and achieves persistence using public techniques, masquerades the original binary as C:\\ProgramData\\Microsoft\\Windows\\Telemetry\\msedge.exe, and restarts itse","https:\u002F\u002Fsecurelist.com\u002Fmoviereaper-malware-torrent-odyssey-solana\u002F121344\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F09\u002F17114657\u002FOdyssey-and-trojans-again-scaled.jpg","2026-09-17T13:00:53+00:00","2026-09-17T14:00:25.047369+00:00",8,[18],{"name":19,"type":20},"Solana blockchain","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":21,"icon":23,"name":24,"slug":25},null,"Malware","malware",[27,32,34],{"category":28},{"id":29,"icon":23,"name":30,"slug":31},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":33},{"id":21,"icon":23,"name":24,"slug":25},{"category":35},{"id":36,"icon":23,"name":37,"slug":38},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[40],{"type":41,"value":42,"context":43},"domain","itorrents.org","Compromised torrent file repository used for distribution."]