Kaspersky Uncovers MovieReaper Malware Spread Through Torrents

Kaspersky has identified MovieReaper, a previously unknown modular malware framework distributed through compromised torrent-file infrastructure. The campaign was uncovered in mid-August 2026 and has affected several hundred individuals and organisations, with infection attempts reported across Europe, Asia and Africa, including Russia, Türkiye, Japan, Kenya, Uganda, Colombia, Spain, the Netherlands, Belgium and Germany.

Rather than compromising individual torrent trackers, the attackers tampered with the public torrent repository `itorrents[.]org`. Trackers relying on it then returned malicious torrent files when users followed magnet links. The resulting executables were disguised as films, including “the odyssey (2026) [1080p] [webrip] [5.1].exe”; Kaspersky says one widespread loader had MD5 hash `A0B13781EDD7CFDAB13D79AFFF3C83C1`.

The loader uses anti-sandbox techniques, downloads shellcode from `deadhub[.]org` or `193.23.118[.]155`, and executes it in memory. The next stage queries the Solana blockchain’s `getAccountInfo` endpoint to obtain an encrypted address for a second command-and-control server, making the infrastructure harder to disrupt through conventional IP blocking. A subsequent module bypasses User Account Control, establishes persistence and masquerades as `C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe`.

The final “file manager” module provides 21 commands for listing, reading, uploading, downloading, modifying and deleting files, as well as extracting previews and thumbnails.

Kaspersky says the campaign’s first-stage server remains the clearest disruption point and detects the malware as `HEUR:Trojan.Win64.Agent.gen`. It advises defenders to use the published indicators of compromise, including the listed domains, IP addresses, file hashes, path and mutexes, while noting that the modular framework could be reused in later campaigns.