KASPERSKY says it has identified a previously unknown modular malware framework, dubbed MovieReaper, distributed through compromised torrent files. The campaign was detected in mid-August 2026 and has produced several hundred victims, including individuals and organisations in countries such as Russia, Türkiye, Japan, Kenya, Uganda, Colombia, Spain, the Netherlands, Belgium and Germany.
The attackers reportedly compromised the public torrent repository `itorrents[.]org`, rather than the individual tracker sites that used it. As of the report’s publication, the archive remained compromised: magnet-link requests could return a malicious torrent leading to a loader disguised as a film or other popular content.
The loader uses anti-sandboxing techniques and downloads shellcode from `deadhub[.]org`, with `193.23.118[.]155` as a plain-HTTP fallback. The next stage queries the Solana blockchain’s `getAccountInfo` endpoint for the address `6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm`; encrypted data in the response provides the address of a second command-and-control server.
Kaspersky says later modules bypass User Account Control, establish persistence as `C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe`, and expose 21 commands for remotely listing, reading, uploading, downloading and manipulating files, including image and file previews. The campaign targets sectors including government, enterprise, IT, retail, transport and agriculture.
Kaspersky detects the threat as `HEUR:Trojan.Win64.Agent.gen`. It says the clearest disruption point is the first-stage domain and IP address, while the blockchain-based C2 is more resistant to conventional takedowns. The report includes hashes, file paths, mutexes and additional C2 indicators for investigation.