The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents
Kaspersky uncovers MovieReaper, a multi-stage malware framework spread via compromised itorrents.org torrent files, hitting hundreds of users.
In mid-August 2026 Kaspersky identified a campaign distributing an unknown loader disguised as movies such as 'the odyssey (2026) [1080p] [webrip] [5.1].exe' (MD5 A0B13781EDD7CFDAB13D79AFFF3C83C1) through torrent trackers. The attackers compromised the itorrents[.]org torrent-file repository rather than the trackers themselves, so multiple platforms delivered malicious torrents; the repository remained compromised at publication. Several hundred victims, including individuals and organizations in Russia, Türkiye, Japan, Kenya, Uganda, Colombia and several European countries, were infected with the modular MovieReaper framework, detected as HEUR:Trojan.Win64.Agent.gen. The loader fetches shellcode from deadhub[.]org (fallback IP 193.23.118[.]155), maps it into RWX memory, and uses PEB traversal, encrypted strings and direct syscalls to evade sandboxes.
- Threat actors compromised the itorrents[.]org repository, still compromised at publication
- Loader MD5 A0B13781EDD7CFDAB13D79AFFF3C83C1 identical across disguised movie executables
- Several hundred victims including organizations across at least ten countries
- Loader fetches shellcode from deadhub[.]org with HTTP fallback to 193.23.118[.]155
- Evades sandboxes via PEB traversal, direct syscalls and encrypted strings
- ATT&CK
- T1204.002 Malicious FileT1105 Ingress Tool TransferT1620 Reflective Code LoadingT1027.007 Dynamic API ResolutionT1106 Native API
- Vendors
- Kaspersky
- Malware
- MovieReaper
- Organizations
- itorrents.org
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | api.mainnet.solana.com | campaign leverages the legitimate Solana blockchain via the api.mainnet.solana.com RPC endpoint to deliver the address of the second‑stage C2 |
| domain | deadhub.org | memory and execute. While doing it, loader decodes https://deadhub[.]org domain name and if connection to it has failed, then it u |
| domain | itorrents.org | promised a widely used public repository of torrent files — itorrents[.]org . As a result, torrent trackers that relied on this repos |
| ipv4 | 193.23.118.155 | ection to it has failed, then it uses the IP address http://193.23.118[.]155 as a fallback and connects to it using plain HTTP. Malwar |
| ipv4 | 208.64.33.90 | t-stage C2: deadhub[.]org 193.23.118[.]155 Second-stage C2: 208.64.33[.]90 208.94.246[.]53 |
| ipv4 | 208.94.246.53 | dhub[.]org 193.23.118[.]155 Second-stage C2: 208.64.33[.]90 208.94.246[.]53 |
| md5 | 4843f9fafcae492f11e2d4d33dbb4cdd | s of compromise File hashes 4334BBAEA8DE33BF9D45E9B4E4E3BC2 4843F9FAFCAE492F11E2D4D33DBB4CDD 5310CABAE3FBE6DB8742849B588093F9 A0B13781EDD7CFDAB13D79AFFF |
| md5 | 5310cabae3fbe6db8742849b588093f9 | BAEA8DE33BF9D45E9B4E4E3BC2 4843F9FAFCAE492F11E2D4D33DBB4CDD 5310CABAE3FBE6DB8742849B588093F9 A0B13781EDD7CFDAB13D79AFFF3C83C1 70060341CAF3338697A7DDFE0F |
| md5 | 70060341caf3338697a7ddfe0fb62875 | BAE3FBE6DB8742849B588093F9 A0B13781EDD7CFDAB13D79AFFF3C83C1 70060341CAF3338697A7DDFE0FB62875 AD4643EEA15AC286FA47D1131F9EF756 D0B967571AC8A3863C7F324BF5 |
| md5 | a0b13781edd7cfdab13d79afff3c83c1 | 2026) [1080p] [webrip] [5.1].exe ), but the file hash (MD5: A0B13781EDD7CFDAB13D79AFFF3C83C1 ) was identical across all downloads. We have seen multiple |
| md5 | ad4643eea15ac286fa47d1131f9ef756 | 81EDD7CFDAB13D79AFFF3C83C1 70060341CAF3338697A7DDFE0FB62875 AD4643EEA15AC286FA47D1131F9EF756 D0B967571AC8A3863C7F324BF5BDE99C D88D550D0FB8E60CFFFF3EA61F |
| md5 | d0b967571ac8a3863c7f324bf5bde99c | 41CAF3338697A7DDFE0FB62875 AD4643EEA15AC286FA47D1131F9EF756 D0B967571AC8A3863C7F324BF5BDE99C D88D550D0FB8E60CFFFF3EA61FF7A067 File paths %ProgramData%\M |
| md5 | d88d550d0fb8e60cffff3ea61ff7a067 | EEA15AC286FA47D1131F9EF756 D0B967571AC8A3863C7F324BF5BDE99C D88D550D0FB8E60CFFFF3EA61FF7A067 File paths %ProgramData%\Microsoft\Windows\Telemetry\msedge |
From the original article
7 min read at securelist.com
Kaspersky experts have discovered a new MovieReaper campaign. The multi-stage Trojan spreads through movie torrents, such as "The Odyssey," and uses the Solana blockchain to hide its C2 infrastructure.
By Konstantin Isakov, Pavel Cheremushkin · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.