"We have identified a previously unknown modular, multi-stage framework that we dubbed MovieReaper." — Kaspersky.
In mid‑August 2026 security researchers uncovered a mass infection campaign that used compromised torrent file storage to deliver a modular malware framework now called MovieReaper. The campaign has infected several hundred victims — both individuals and organizations — across Europe, Asia and Africa, and Kaspersky products detect the threat as HEUR:Trojan.Win64.Agent.gen.
Compromised repository itorrents[.]org and torrent distribution
Attackers did not need to breach multiple trackers. Instead, they altered a widely used public archive of torrent files — itorrents[.]org — so that magnet links returned malicious torrent files. As a result, torrent trackers that relied on that archive began inadvertently distributing malware disguised as popular movies (one common filename observed was "odyssey (2026) [1080p] [webrip] [5.1].exe"). The archive remained compromised at the time of the report.
MovieReaper’s multi‑stage architecture and sandbox evasion
The infection chain is multi‑stage and designed to minimize on‑disk presence and evade sandbox analysis. The initial loader (one identical sample hash: MD5 A0B13781EDD7CFDAB13D79AFFF3C83C1) uses long filenames and familiar icons to hide its executable nature. On execution it creates a global mutex (examples include Global\fnulSktzSqvVLXHU and Global\E4AyDKzvEhe2hgAr) and performs a series of anti‑sandbox techniques.
Rather than using LoadLibrary and GetProcAddress, the loader traverses the Ldr list from the PEB and manually parses loaded DLLs to locate functions. It registers a vectored exception handler, rewrites the handler address to trigger a controlled debug break and then invokes a raw syscall (using the "0x0F 0x05" instruction found in ntdll) to call NtProtectVirtualMemory. The loader also calls an undocumented ntdll function, EtwpCreateEtwThread, to execute shellcode.
The loader decodes the domain deadhub[.]org and, on failure, falls back to the IP 193.23.118[.]155 over plain HTTP. It requests shellcode in parts using random path strings (for example, /cloud/v192.4/ui/sync-status-icons.png) and maps and executes the downloaded shellcode in memory.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildUse of the Solana blockchain and modular C2 stages
The second‑stage shellcode reaches out to the Solana blockchain via the /getAccountInfo RPC for account 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm. The response’s data field holds a base64‑encoded second‑stage C2 address encrypted with a static XOR key embedded in the shellcode. The threat actor stored that data using a simple Solana program at address CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL and used api.mainnet.solana.com as the RPC endpoint.
The second‑stage payload then communicates with its C2 strictly over HTTPS with TLS certificate pinning and uses nanopb protobuf as the container for transferred data. Its initial commands include parsing a COFF file and invoking a module_init function, which lets the operator extend functionality dynamically.
Persistence, lateral capabilities and final "file manager"
A later module performs UAC bypass and achieves persistence using public techniques, masquerading the binary as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe and restarting itself. The respawned process runs the loader with a special command‑line argument to skip anti‑sandbox checks; a beacon flag indicates to the C2 whether the implant is running from the Telemetry folder so the server can distinguish first‑run from respawned instances.
The final observed module, described as a "file manager," exposes 21 commands allowing full filesystem access: download, upload, read files, list directories, create/copy/rename/move/delete, chmod and symlink operations, and preview/thumbnail functionality to exfiltrate image previews before full extraction. Kaspersky notes additional modules may be fetched on demand.
Victims, infrastructure indicators, and detection
Kaspersky identified infections in multiple countries including Russia, Türkiye, Japan, Kenya, Uganda, Colombia, Spain, the Netherlands, Belgium, Germany, Finland, Nepal, Tanzania and Ghana. Targets included both individual users and organizations across enterprise, government, IT, consulting, retail, transportation and agriculture sectors.
- First‑stage C2: deadhub[.]org and 193.23.118[.]155
- Second‑stage C2 IPs: 208.64.33[.]90 and 208.94.246[.]53
- Example file path used for persistence: %ProgramData%\Microsoft\Windows\Telemetry\msedge.exe
- Observed mutexes: Global\E4AyDKzvEhe2hgAr, Global\fnulSktzSqvVLXHU
- Detection name: HEUR:Trojan.Win64.Agent.gen
- Sample file hashes (selection): 4334BBAEA8DE33BF9D45E9B4E4E3BC2, 4843F9FAFCAE492F11E2D4D33DBB4CDD, 5310CABAE3FBE6DB8742849B588093F9, A0B13781EDD7CFDAB13D79AFFF3C83C1
The researchers conclude that the clearest point for disruption is the first stage, which relies on a single domain and IP to deliver the shellcode; by contrast the second stage’s use of the Solana blockchain increases resilience against conventional takedown efforts. Kaspersky reports actor activity dating back to October 2025 and says it will continue monitoring.
