The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through compromised torrents

A large-scale malware campaign was identified, beginning in mid-August 2026, involving malware disguised as popular movies that infected both individuals and organizations across numerous countries, including those in Russia, Türkiye, Japan, Kenya, Uganda, Colombia, Spain, the Netherlands, Belgium, and Germany. The infection vector utilized compromised torrent trackers, where threat actors modified a public repository to distribute malicious files instead of legitimate content. This mechanism allowed the malware loader to be distributed across multiple trackers simultaneously without compromising each platform individually.
The malware employs a modular, multi-stage framework dubbed MovieReaper, which involves several distinct stages: a loader, shellcode execution via a specific syscall redirection, communication with a Solana blockchain for C2, and final persistence mechanisms that include UAC bypass and masquerading as system files. The infection chain leverages the public nature of the Solana blockchain to store C2 addresses, adding resilience against takedown efforts.
The initial stage relies on compromised torrent trackers distributing an executable loader, which then uses specific methods to evade detection by antivirus solutions while downloading subsequent stages. Infrastructure for Command and Control (C2) utilized both standard web protocols (HTTP with specified domains/IPs) and the decentralized Solana network for secondary communication, which complicates defensive actions focused solely on traditional IP blocking.

* The infection campaign was identified in mid-August 2026.
* The malware disguised itself as popular movies.
* The primary infection vector involved compromised torrent trackers and the modification of a public repository like itorrents.org to distribute malicious files.
* The initial executable loader used an identical MD5 hash (A0B13781EDD7CFDAB13D79AFFF3C83C1) across multiple downloads.
* The loader avoids standard library calls by manually parsing the PEB's Ldr list to find function addresses.
* The loader communicates with a C2 server via HTTPS, falling back to plain HTTP using specific domains (deadhub[.]org) and IP addresses (193.23.118[.]155).
* The second stage payload interacts with the Solana blockchain endpoint /getAccountInfo for account 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm to retrieve an encrypted C2 address.
* Persistence was achieved by masquerading the binary as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe.
* The final implant exposes 21 filesystem commands, including read, write, copy, delete, and symlink operations.
* Indicators of compromise include file hashes (e.g., A0B13781EDD7CFDAB13D79AFFF3C83C1), mutexes (e.g., Global\fnulSktzSqvVLXHU), and C2 addresses.

The narrative reveals a transition from traditional malware distribution methods to leveraging decentralized infrastructure for command and control, indicating an evolution in threat actor sophistication. The use of compromised torrent trackers as an initial vector highlights the persistent weakness in relying on peer-to-peer distribution channels, regardless of security posture. This initial phase sets up a successful social engineering pathway by normalizing the execution of malware via commonly sought content.
The shift to a modular framework like MovieReaper suggests an intentional effort toward resilience and extensibility. By embedding multi-stage logic and using blockchain technology for C2 storage, the actors complicate the work of defenders who typically focus on blocking static IP addresses. This implies a paradigm shift where infrastructure takedowns must account for distributed ledger technologies rather than just network boundaries.
The importance of the initial stage lies in its central dependency on a single point—the shellcode delivery mechanism via specific HTTP endpoints—which serves as the most immediate leverage point for disruption. The modular nature, combined with in-memory execution and advanced evasion techniques (like modifying exception handlers), demonstrates an operational maturity where the focus is less on hiding the existence of the code and more on evading automated analysis environments. The core implication is that to counter this evolution, defenses must move beyond signature or IP blocking to analyze behavioral flows across heterogeneous systems and decentralized networks.
Bridge Questions: If infrastructure takedowns prove ineffective against blockchain-based C2 storage, what new detection methodologies can effectively map and disrupt these decentralized command structures? How does the ability of actors to use publicly available content as a precursor for infection change the responsibility of content distributors versus platform providers? What are the long-term implications for trust in file-sharing ecosystems when they become primary infection vectors?