Hackers Poison Movie Torrents With MovieReaper Malware That Uses Solana for C2
Poisoned movie torrents deliver MovieReaper malware using Solana blockchain for resilient C2, infecting several hundred victims across multiple continents.
Securelist reports a new Windows malware framework dubbed MovieReaper distributed through poisoned torrent downloads of popular films, with several hundred victims identified across Europe, Asia, and Africa, including organizations in government, IT, retail, transport, consulting, and agriculture. A loader disguised as a movie release file runs staged payloads largely in memory, installs persistence masquerading as Windows telemetry (msedge.exe under ProgramData), bypasses UAC, and grants operators broad file access for data theft. Unusually, the shellcode queries a Solana account via getAccountInfo to decode later command-and-control addresses, complicating takedowns, and the second stage uses HTTPS with a pinned certificate. Actor activity dates back to October 2025 and involves a compromised public torrent-file repository.
- Loader masquerades as movie releases such as 'the odyssey (2026) [1080p].exe' with hidden .exe extension
- Solana getAccountInfo queries encode C2 addresses, making takedowns harder
- Malware poses as msedge.exe under a Windows telemetry path and bypasses UAC for persistence
- Victims span Europe, Asia, and Africa, including government, IT, retail, and transport organizations
- Compromised itorrents[.]org repository served malicious torrents across multiple trackers
- ATT&CK
- T1204.002 User Execution: Malicious FileT1036.007 Masquerading: Double File ExtensionT1548.002 Abuse Elevation Control Mechanism: Bypass User Account ControlT1620 Reflective Code LoadingT1071.001 Application Layer Protocol: Web Protocols
- Vendors
- Kaspersky
- Products
- MovieReaper
- Malware
- MovieReaper
- Organizations
- Securelist
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | deadhub.org | l\fnulSktzSqvVLXHU Observed MovieReaper loader mutex Domain deadhub[.]org First-stage command-and-control domain used to retrieve s |
| domain | itorrents.org | rs of compromise (IoCs):- Type Indicator Description Domain itorrents[.]org Public torrent-file repository reported as compromised an |
| ipv4 | 193.23.118.155 | nd-and-control domain used to retrieve shellcode IP address 193.23.118[.]155 Fallback first-stage command-and-control IP address URL p |
| ipv4 | 208.64.33.90 | edly used by the attackers to store account data IP address 208.64.33[.]90 Second-stage command-and-control infrastructure IP addres |
| ipv4 | 208.94.246.53 | Second-stage command-and-control infrastructure IP address 208.94.246[.]53 Second-stage command-and-control infrastructure Note: IP |
| md5 | 4843f9fafcae492f11e2d4d33dbb4cdd | E33BF9D45E9B4E4E3BC2 MovieReaper-related file hash MD5 hash 4843F9FAFCAE492F11E2D4D33DBB4CDD MovieReaper-related file hash MD5 hash 5310CABAE3FBE6DB8742 |
| md5 | 5310cabae3fbe6db8742849b588093f9 | 492F11E2D4D33DBB4CDD MovieReaper-related file hash MD5 hash 5310CABAE3FBE6DB8742849B588093F9 MovieReaper-related file hash MD5 hash A0B13781EDD7CFDAB13D |
| md5 | 70060341caf3338697a7ddfe0fb62875 | iated with the commonly distributed initial loader MD5 hash 70060341CAF3338697A7DDFE0FB62875 MovieReaper-related file hash MD5 hash AD4643EEA15AC286FA47 |
| md5 | a0b13781edd7cfdab13d79afff3c83c1 | E6DB8742849B588093F9 MovieReaper-related file hash MD5 hash A0B13781EDD7CFDAB13D79AFFF3C83C1 Hash associated with the commonly distributed initial loade |
| md5 | ad4643eea15ac286fa47d1131f9ef756 | 338697A7DDFE0FB62875 MovieReaper-related file hash MD5 hash AD4643EEA15AC286FA47D1131F9EF756 MovieReaper-related file hash MD5 hash D0B967571AC8A3863C7F |
| md5 | d0b967571ac8a3863c7f324bf5bde99c | C286FA47D1131F9EF756 MovieReaper-related file hash MD5 hash D0B967571AC8A3863C7F324BF5BDE99C MovieReaper-related file hash MD5 hash D88D550D0FB8E60CFFFF |
| md5 | d88d550d0fb8e60cffff3ea61ff7a067 | A3863C7F324BF5BDE99C MovieReaper-related file hash MD5 hash D88D550D0FB8E60CFFFF3EA61FF7A067 MovieReaper-related file hash File path %ProgramData%\Micro |
From the original article
4 min read at cybersecuritynews.com
Movie torrents are being used to deliver a new Windows malware framework called MovieReaper. Attackers have poisoned torrent downloads for popular films, turning a routine search for entertainment into a route for remote access and data theft. The campaign has reached users and organizations across several countries.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.