MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana Blockchain for C2
MovieReaper Malware Spreads Through Pirated Movie Torrents (TL-2026-2560), also tracked as HEUR:Trojan.Win64.Agent.gen, is a high-severity malware campaign, first published 2026-09-18. It has no confirmed attribution, affects Microsoft Windows (Desktop), maps to 15 MITRE ATT&CK techniques (T1005, T1027, T1027.007), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-2560
- Threat ID
- TL-2026-2560
- Also known as
- HEUR:Trojan.Win64.Agent.gen
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-18
- Last reviewed
- 2026-09-18
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, it, consulting, retail, transport, agriculture, enterprise
- Target regions
- Europe, Asia, Africa, Latin America
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in MovieReaper Malware Spreads Through Pirated Movie Torrents
Malware and tooling: MovieReaper, PoisonIvy, nanopb
MovieReaper is a multi-stage Windows trojan distributed after threat actors compromised itorrents[.]org, a shared public torrent-file repository, to serve a malicious loader disguised as movie releases such as "The Odyssey" instead of the requested torrent. The loader achieves UAC bypass and masquerades as msedge.exe, then resolves a resilient second-stage C2 address by querying the Solana blockchain's getAccountInfo RPC method, ultimately deploying a 21-command remote file-manager implant. Kaspersky (detection: HEUR:Trojan.Win64.Agent.gen) traced several hundred victims across ten-plus countries and confirmed the repository remained compromised at time of publication.
How MovieReaper Malware Spreads Through Pirated Movie Torrents works
MovieReaper is a four-to-five-stage modular Windows trojan framework first traced by Kaspersky GReAT researchers Konstantin Isakov and Pavel Cheremushkin to activity beginning October 2025, with the current campaign identified in mid-August 2026 and confirmed via a September 17, 2026 investigation. Rather than compromising individual torrent trackers, the operators compromised itorrents[.]org — a centralized, shared repository of torrent metadata files relied upon by multiple independent tracker sites — so that magnet-link requests for popular movie releases (observed decoy: "the odyssey (2026) [1080p] [webrip] [5.1].exe") returned a malicious .exe instead of the legitimate torrent. This single-point compromise let the actor reach users across many trackers without breaching each platform individually, and the repository remained compromised as of the report's publication.
Stage 1 (loader, detected as HEUR:Trojan.Win64.Agent.gen) creates a randomly generated global mutex (observed values include Global\fnulSktzSqvVLXHU and Global\E4AyDKzvEhe2hgAr) to prevent multiple concurrent instances, then performs anti-analysis: strings are protected with a custom stream cipher, and API addresses are resolved via manual Windows PEB/Ldr traversal and direct DLL parsing rather than conventional LoadLibrary/GetProcAddress calls. The loader registers a vectored exception handler and manually invokes NtProtectVirtualMemory by locating the raw syscall instruction (0x0F 0x05) inside ntdll, then executes retrieved code via the undocumented EtwpCreateEtwThread routine instead of CreateThread — evading hooks placed on conventional thread-creation APIs. The loader also performs sandbox/VM detection before proceeding.
Stage 2 shellcode is retrieved from deadhub[.]org over HTTPS (with a plaintext HTTP fallback to 193.23.118[.]155), disguised behind randomized image-style URI paths mimicking a cloud-storage UI asset tree — observed examples include /cloud/v192.4/ui/sync-status-icons.png, /cloud/v192.4/onboarding/welcome-bg.jpg, /cloud/v192.4/ui/file-preview-placeholder.png, and /cloud/v192.4/shared/link-banner.jpg. This shellcode then queries the Solana blockchain's public getAccountInfo RPC endpoint (api.mainnet.solana.com) against account 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm (associated program address CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL), extracting a base64-encoded second-stage C2 address decrypted with a static XOR key from the account's on-chain data field. This gives the operators a resilient, takedown-resistant infrastructure layer: they can rotate the live C2 IP by updating the Solana account rather than re-infecting hosts. Observed second-stage C2 IPs are 208.64.33[.]90 and 208.94.246[.]53, reached over HTTPS with TLS certificate pinning; data is containerized using the nanopb Protocol Buffers library, and additional modules are delivered and executed in memory as parsed COFF objects via a module_init routine (reflective loading, no additional payload written to disk). Neither second-stage IP returned an existing BeaconBeagle C2 correlation record at research time (queried 2026-09-18; both endpoints 404 — no prior beacon/config match on file), consistent with freshly rotated, purpose-built infrastructure rather than reused/shared C2.
A UAC-bypass stage relocates/respawns the binary as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe — masquerading as a legitimate Microsoft Edge telemetry component in a plausible ProgramData path — with a command-line flag that causes the respawned instance to skip the anti-sandbox checks performed on first run, and a beacon flag informs the C2 whether the host is a fresh or already-persistent install so the appropriate follow-on module is delivered. Public reporting does not disclose the specific UAC-bypass method (e.g., fodhelper/eventvwr-style) or a boot-persistence artifact (no registry Run key or scheduled task name has been published), only the relocation/masquerade and respawn behavior described above.
The final delivered module is a file-manager implant exposing 21 commands covering directory listing/enumeration, file read/upload/download, create/copy/move/rename/delete, permission (chmod-style) changes, symbolic-link creation, and file/image preview or thumbnail extraction — the last explicitly noted as supporting pre-exfiltration reconnaissance before an operator pulls specific files. Additional modules can be requested from C2 on demand.
The "The Odyssey" decoy filename tracks a real theatrical release (July 15, 2026), and Kaspersky frames the campaign as an evolution of the October 2025-origin activity, with incrementally improved detector/sandbox-evasion techniques observed over the roughly eleven-month window before the itorrents[.]org compromise was confirmed.
Kaspersky identified several hundred victims, both individuals and organizations, with infection attempts observed across Europe, Asia, and Africa, and corroborating reporting listing Russia, Turkiye, Japan, Kenya, Uganda, Colombia, Nepal, Tanzania, Ghana, Spain, the Netherlands, Belgium, Finland, and Germany (France notably absent from all reported victim lists); organizational victims spanned government, IT, consulting, retail, transportation, and agriculture sectors. No CVE applies — this is a social-engineering/supply-chain-style distribution-repository compromise, not a software vulnerability, and no threat-actor name or nation-state attribution has been published. One secondary aggregator (CraftedSignal) additionally attributed a registry-based UAC-bypass persistence technique and a "blockchain DGA" classification to MovieReaper; both are excluded here as unsupported by, and directly contradicted by, Kaspersky's primary Securelist research, which states explicitly that no registry Run key or scheduled-task artifact has been published and describes the Solana lookup as a dead-drop resolver rather than a domain-generation algorithm.
MITRE ATT&CK techniques used in TL-2026-2560
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1027.007 Dynamic API Resolution; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Command and Control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1132.001 Standard Encoding
Execution
T1106 Native API; T1204.002 Malicious File
Initial Access
T1195.002 Compromise Software Supply Chain
Discovery
T1497 Virtualization/Sandbox Evasion
Privilege Escalation
T1548.002 Bypass User Account Control
Resource Development
Affected products and versions in MovieReaper Malware Spreads Through Pirated Movie Torrents
- Microsoft — Windows (Desktop)
Vulnerable versions: All currently supported Windows 10/11 desktop builds capable of running a standard 64-bit executable — infection is via user execution of a disguised loader, not a version-specific software flaw
Remediation for MovieReaper Malware Spreads Through Pirated Movie Torrents
Immediate actions
- Block network indicators deadhub[.]org, 193.23.118[.]155, 208.64.33[.]90, and 208.94.246[.]53 at DNS/proxy/perimeter firewalls
- Hunt EDR/file-integrity telemetry for C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe (the real msedge.exe never lives in ProgramData) and isolate/quarantine any match
- Search endpoint and file-hash telemetry for the eight published MovieReaper MD5 hashes; treat any match as a confirmed compromise requiring full incident response
- Notify users/IT that itorrents[.]org-sourced torrent files are malicious regardless of which tracker referenced them, and block the domain at network egress until the repository operator confirms remediation
Workarounds
- Avoid downloading or executing any torrent file sourced via itorrents[.]org until the repository operator confirms remediation
- Treat any .exe delivered by a torrent client as untrusted regardless of the display name/extension shown by the requesting tracker
Longer-term hardening
- Add detection logic for endpoint processes making outbound getAccountInfo-style JSON-RPC calls to public blockchain RPC endpoints (e.g. api.mainnet.solana.com) — an emerging dead-drop-resolver C2 pattern not covered by traditional domain/IP reputation feeds
- Enforce application allowlisting or ASR rules blocking unsigned executables launched from Downloads/Temp or torrent-client working directories
- Deploy TLS-inspection/egress monitoring capable of flagging certificate-pinned, protobuf-serialized C2 traffic patterns distinct from normal HTTPS
- Run a user-awareness campaign on piracy-sourced malware risk given the confirmed, still-active compromise of a widely trusted shared torrent-file repository
Timeline of MovieReaper Malware Spreads Through Pirated Movie Torrents
- Kaspersky links earlier activity by the same threat actor to October 2025, roughly ten months before the confirmed MovieReaper campaign (exact day not disclosed in public reporting); Kaspersky characterizes the campaign as evolving over this window with incrementally improved anti-sandbox and detector-evasion techniques.
- "The Odyssey" has its real-world theatrical release; the film's title and 2026 release year are later reused verbatim as the decoy filename ("the odyssey (2026) [1080p] [webrip] [5.1].exe") served by the compromised itorrents[.]org repository.
- Kaspersky begins investigating the MovieReaper campaign after identifying malicious torrent downloads disguised as movie releases (mid-August 2026; exact day not disclosed).
- Kaspersky GReAT (Konstantin Isakov, Pavel Cheremushkin) publishes MovieReaper technical research on Securelist, detailing the multi-stage loader, Solana blockchain C2-resolution mechanism, UAC bypass, and 21-command file-manager implant.
- Kaspersky researchers confirm itorrents[.]org, a shared public torrent-file repository used by multiple trackers, is compromised and serving MovieReaper payloads in place of legitimate torrent files, with several hundred victims identified across multiple countries.
- Security trade press (GBHackers, Gridinsoft, it-connect.tech, NetManageIT) reports on the Kaspersky findings; itorrents[.]org remains compromised and actively serving the malicious payload at time of publication.
Sources cited for MovieReaper Malware Spreads Through Pirated Movie Torrents
- MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2
- MovieReaper: Trojan attack via movie torrents, including "The Odyssey"
- MovieReaper Turns Movie Torrents Into Remote File Access
- iTorrents.org compromised to spread a Windows malware loader instead of movies
- MovieReaper Torrent Trojan and Solana C2 Analysis
More in malware
- AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28)
- EtherHiding / Blockchain Dead Drops: Nation-State Actors Drive 440% Surge in On-Chain Malware C2
- KREMLIN Banking Malware Forges Chrome/Edge Secure Preferences Integrity Checks to Force-Install Malicious 'AVSync' Extension
- Iranian State Actors Deploy CHOSEN BRICK Windows Malware to Spy on Dissidents, Activists, and Journalists
- Chosen Brick: Iranian State-Sponsored Windows Surveillance Malware Exposed by US, UK, and Dutch Agencies
Detection coverage for TL-2026-2560
As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2560 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.