Hackers Poison Movie Torrents With MovieReaper Malware That Uses Solana for C2

Movie torrents are being used to deliver a new Windows malware framework called MovieReaper. Attackers have poisoned torrent downloads for popular films, turning a routine search for entertainment into a route for remote access and data theft.

The campaign has reached users and organizations across several countries. Victims who use a magnet link may receive a malicious torrent file instead of the movie they expected.

The altered file downloads a loader disguised as a media release, often with a long name designed to hide its executable extension. Once opened, it begins a staged compromise that largely runs in memory.

Analysts linked the activity to compromised storage used by torrent trackers rather than a breach of every tracker itself. That distinction let the operators reach multiple services through one poisoned repository.

Securelist said in a report shared with Cyber Security News (CSN) that investigators identified several hundred victims. Observed infections span Europe, Asia, and Africa, affecting private users as well as organizations in government, IT, retail, transport, consulting, and agriculture.

The breadth of those targets shows why poisoned downloads remain a problem: a single compromised distribution point can expose people who never visit the same torrent website.

Some infections were found in Russia, Türkiye, Japan, Kenya, Uganda, Colombia, Spain, the Netherlands, Belgium, and Germany during the first reported campaign wave.

Hackers Poison Movie Torrents With MovieReaper Malware

The first-stage loader has appeared under names such as “the odyssey (2026) [1080p] [webrip] [5.1].exe,” while sharing the same MD5 hash across downloads.

It uses a familiar application icon and an oversized filename to make the final .exe less obvious. This social engineering relies on victims launching what looks like video content.

Before contacting its operators, the loader performs checks intended to frustrate automated analysis. It avoids common Windows calls, uses a vectored exception handler, and executes the next component in memory.

Readers tracking similar evasive behavior can compare Windows UAC bypass technique, where trusted-looking Windows paths and elevation weaknesses were also used to reduce suspicion.

MovieReaper then reaches a first-stage server for shellcode, using a domain and a fallback IP address. The payload fetches extra code in fragments that resemble harmless cloud-service image paths.

It later installs itself under a Windows telemetry-looking location, bypasses User Account Control, and restarts to preserve access after the victim logs back in.

The final module gives the operators broad control over files, including the ability to read, upload, download, rename, move, and delete them.

It can also create previews and thumbnails before taking content, helping attackers choose valuable files. That modular design means further capabilities can be delivered only when an operator decides they are needed.

Solana-Based C2 Strengthens Resilience

The campaign’s most unusual feature is its use of the Solana blockchain to locate a later command-and-control server. The shellcode queries a specific account through Solana’s getAccountInfo endpoint, then decodes an encrypted address stored in the returned data.

This makes the communication path harder to disrupt than a conventional server list. Blockchain-based control does not make the malware invisible, but it can complicate takedowns because the attacker can update destination data without depending on one ordinary website.

A related Developer-targeting Glassworm malware campaign likewise used Solana to distribute instructions, illustrating how criminals are adapting public blockchain services for operational resilience.

MovieReaper’s second-stage component uses HTTPS with a pinned certificate and can load add-on modules directly into memory. Researchers say the actor’s activity dates to October 2025 and has evolved to make the loader harder to detect.

The PHANTOMPULSE blockchain C2 analysis similarly shows how memory execution, privilege bypasses, and decentralized control can reinforce one another.

Defenders should block the indicators in the table, investigate systems with unusual torrent downloads, and review suspicious executions carefully.

Users should avoid pirated installers and never disable protection to run them on personal devices. For another supply-chain example, the Solana FakeFix supply-chain campaign shows why unverified software sources can quickly expose credentials and sensitive data.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Domain	itorrents[.]org	Public torrent-file repository reported as compromised and used to distribute malicious torrent files
File name	the odyssey (2026) [1080p] [webrip] [5.1].exe	Example MovieReaper loader filename masquerading as a movie release
MD5 hash	4334BBAEA8DE33BF9D45E9B4E4E3BC2	MovieReaper-related file hash
MD5 hash	4843F9FAFCAE492F11E2D4D33DBB4CDD	MovieReaper-related file hash
MD5 hash	5310CABAE3FBE6DB8742849B588093F9	MovieReaper-related file hash
MD5 hash	A0B13781EDD7CFDAB13D79AFFF3C83C1	Hash associated with the commonly distributed initial loader
MD5 hash	70060341CAF3338697A7DDFE0FB62875	MovieReaper-related file hash
MD5 hash	AD4643EEA15AC286FA47D1131F9EF756	MovieReaper-related file hash
MD5 hash	D0B967571AC8A3863C7F324BF5BDE99C	MovieReaper-related file hash
MD5 hash	D88D550D0FB8E60CFFFF3EA61FF7A067	MovieReaper-related file hash
File path	%ProgramData%\Microsoft\Windows\Telemetry\msedge.exe	Persistence location used to masquerade the malware as a Windows telemetry executable
Mutex	Global\E4AyDKzvEhe2hgAr	Observed MovieReaper loader mutex
Mutex	Global\fnulSktzSqvVLXHU	Observed MovieReaper loader mutex
Domain	deadhub[.]org	First-stage command-and-control domain used to retrieve shellcode
IP address	193.23.118[.]155	Fallback first-stage command-and-control IP address
URL path	/cloud/v192.4/ui/sync-status-icons.png	Example path used to request shellcode fragments
URL path	/cloud/v192.4/onboarding/welcome-bg.jpg	Example path used to request shellcode fragments
URL path	/cloud/v192.4/ui/file-preview-placeholder.png	Example path used to request shellcode fragments
URL path	/cloud/v192.4/shared/link-banner.jpg	Example path used to request shellcode fragments
Solana RPC endpoint	api.mainnet.solana.com/getAccountInfo	Blockchain endpoint queried to obtain later-stage C2 information
Solana account	6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm	Account containing encoded data used to resolve the second-stage C2
Solana program	CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL	Solana program reportedly used by the attackers to store account data
IP address	208.64.33[.]90	Second-stage command-and-control infrastructure
IP address	208.94.246[.]53	Second-stage command-and-control infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC