> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents - URL: https://f4n6.co.uk/security-feed/the-odyssey-and-trojans-again-moviereaper-attacks-users-in-multiple-countries-via-compromised-torrents/ - Published: 2026-09-17T13:58:30.000Z - Updated: 2026-09-17T13:58:30.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary A previously unknown modular, multi-stage Windows crimeware framework — dubbed **MovieReaper** — has been distributed at scale since mid-August 2026 through malicious torrent files served by the compromised public torrent repository `itorrents[.]org`, which downstream trackers rely on. Kaspersky reports several hundred victims, both individuals and organisations, across Europe (Spain, Netherlands, Belgium, Germany, Finland), Asia and Africa; targeted sectors include enterprise, government, IT, consulting, retail, transportation and agriculture. No CVE is associated with this campaign and no verified CVSS or CISA KEV data applies — the vector is user-executed pirated media, not a software vulnerability. The bottom-line risk to EMEA financial services is concentrated and specific: any corporate Windows endpoint where a user runs pirated film or software content is a viable entry point, and the final-stage module grants the operator full filesystem read/write and file-preview exfiltration over 21 commands. **All technical detail in this advisory is single-sourced to Kaspersky SecureList; no second vendor has corroborated the framework, its infrastructure or its victim counts.** ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The campaign's distribution vector is consumer piracy infrastructure (`itorrents[.]org` and public torrent trackers), which is not an ICT third-party provider relationship under DORA Art. 28–30, and no incident at a client is established by the source material. If a client independently confirms MovieReaper on an in-scope production asset, DORA Art. 17 (ICT-related incident management process), Art. 18 (classification of ICT-related incidents and cyber threats) and Art. 19 (reporting of major ICT-related incidents to competent authorities) would be engaged by that confirmed incident — not by this advisory. ## 3\. Technical analysis & attack chain ### Confirmed attack chain 1. **Distribution.** The threat actor compromised `itorrents[.]org`, a widely used public repository of torrent files — **not** the individual trackers. Trackers that source torrent files from this repository began serving malicious torrents to their users. When a user requests a torrent via a magnet link, the archive returns a different torrent file than the one requested; that torrent leads to download of the MovieReaper loader. The archive remained compromised as of the report's publication date. 2. **Execution.** The user manually launches the downloaded executable. Observed filenames are deliberately long to push the `.exe` extension out of view, e.g. `the odyssey (2026) [1080p] [webrip] [5.1].exe`, and the binary carries the icon of a well-known application. Multiple loader variants were observed; the most widely distributed sample had MD5 `A0B13781EDD7CFDAB13D79AFFF3C83C1`, identical across all downloads. 3. **Single-instance guard.** The loader creates a global mutex to ensure only one instance runs. Observed values include `Global\fnulSktzSqvVLXHU` and `Global\E4AyDKzvEhe2hgAr`; the string component is randomly generated per sample. 4. **Anti-sandbox / API resolution.** The loader avoids `LoadLibrary` and `GetProcAddress`. It walks the double-linked list from the `Ldr` field of the PEB to locate loaded libraries, then manually parses the DLL to compute the address of each required function. 5. **Stage-1 C2 and shellcode delivery.** The loader decodes the domain `deadhub[.]org` and connects over HTTPS; if that fails it falls back to `http://193.23.118[.]155` over **plain HTTP**. It selects a random group of strings to use as the request path and downloads shellcode in parts. Observed paths: - `/cloud/v192.4/ui/sync-status-icons.png` \- `/cloud/v192.4/onboarding/welcome-bg.jpg` \- `/cloud/v192.4/ui/file-preview-placeholder.png` \- `/cloud/v192.4/shared/link-banner.jpg` 6. **In-memory execution.** The shellcode is mapped into RWX memory and executed. The loader registers a vectored exception handler and rewrites the handler address in memory so that a debug break does not crash the process but redirects control flow into a function that issues a raw `NtProtectVirtualMemory` syscall via the `0x0F 0x05` syscall instruction previously located inside `ntdll`. It then calls the undocumented `ntdll` function `EtwpCreateEtwThread` — a known alternative to `CreateThread` — to execute the shellcode. 7. **Stage-2 C2 resolution via Solana.** The second stage issues an HTTPS request to the Solana blockchain `/getAccountInfo` endpoint for account `6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm`. The `data` field of the response contains the base64-encoded address of the second-stage C2, encrypted with a static XOR key embedded in the shellcode. Data is stored in that account via a simple Solana program at `CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL`. This gives the operator decentralised, takedown-resistant C2 address storage. 8. **Stage-2 implant.** Communicates with its C2 strictly over HTTPS with a **TLS-pinned certificate**, using the `nanopb` protobuf library as the data container. Its primary initial command parses a COFF file, loads it into memory and executes its `module_init` function — an extensible interface for adding commands. Recovered modules were compiled with symbols, which accelerated reverse engineering. 9. **Stage-3 persistence and UAC bypass.** The loaded module performs UAC bypass and establishes persistence using public techniques, masquerades the binary as `C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe`, and restarts itself. 10. **Respawn.** The respawned process re-runs the initial loader with a special command-line argument that skips most anti-sandbox checks and proceeds directly to the stage-2 download. The beacon includes a flag indicating whether the implant is running from the Telemetry folder, letting the C2 distinguish first-run from respawned instances. 11. **Final module — file manager.** Exposes **21 commands** giving the operator filesystem access on the victim host: download, upload and read files; list and enumerate directories; create, copy, rename, move, delete, `chmod` and symlink operations; and preview/thumbnail commands that exfiltrate previews of images and files *before* the operator extracts them. Additional modules are suspected to be loaded on demand. ### Technical notes for defenders - **Only the first stage touches disk.** Everything after the loader is in-memory, which is why the persistence artefact at `C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe` is the highest-value host indicator. - **Obfuscation is limited.** The malware is not heavily obfuscated apart from a custom stream cipher applied to strings. Most countermeasures target AV sandbox evasion rather than static analysis. - **C2 infrastructure** uses various commercial hosting providers. The Solana RPC endpoint used is the legitimate `api.mainnet.solana.com`; blocking it outright is not advisable, but endpoint use of it is anomalous in most corporate estates. - **Disruption point.** The first stage depends on a single domain and a single IP to serve shellcode; taking down that server breaks the chain. The second stage, anchored in Solana, is materially harder to disrupt. - **Actor history.** The same actor's activity is traced back to October 2025, with the loader progressively hardened while the pattern (encoded strings, shellcode delivered over plain HTTP, sandbox/VM evasion) stayed constant. ### Confidence caveats This entire section is **single-sourced to Kaspersky SecureList**; no independent vendor has corroborated the framework, the `itorrents[.]org` compromise, the victim counts or the country list. The source does not name the actor and provides no MITRE ATT&CK group profile — **attribution is therefore unconfirmed and no actor name should be used in reporting**. The eight MD5 values in §5 are published as a flat list without per-file mapping; only `A0B13781EDD7CFDAB13D79AFFF3C83C1` is explicitly tied to the loader. The mutex values are randomly generated per sample and will not generalise. ## 4\. Mitigation & containment There is no vendor patch for this item — it is malware, not a vulnerability. Remediation for a confirmed host is reimage, not cleaning, because the post-loader stages execute entirely in memory. ### P1 — within 24 hours - Block egress at DNS, proxy and firewall to `deadhub[.]org`, `193.23.118[.]155`, `208.64.33[.]90` and `208.94.246[.]53`. Note the stage-1 fallback is **plain HTTP**, so this leg is visible without TLS inspection. - Hunt all Windows endpoints for `C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe`. Legitimate Microsoft Edge does not execute from this path. On a hit: isolate the host, capture memory, then reimage. - Confirm AV/EDR coverage for the Kaspersky detection name `HEUR:Trojan.Win64.Agent.gen` and push current signatures. - Block `itorrents[.]org` at the web proxy — the repository was still serving malicious torrent files at publication. - Alert on any endpoint resolving `deadhub[.]org` or initiating connections to the four IPs above. ### P2 — within 72 hours - Retro-hunt proxy, DNS and firewall logs back to **mid-August 2026** (campaign start) for the four stage-1 URI paths, the C2 domain and the four IPs. Extend to October 2025 if the actor's earlier activity is in scope. - Review EDR telemetry for the injection chain: RWX memory allocation, raw `NtProtectVirtualMemory` syscalls, `EtwpCreateEtwThread` calls, and vectored-exception-handler manipulation. - Force credential reset for any user with confirmed loader execution — the file-manager module provides full filesystem read access, so credential material on disk must be treated as exposed. - Restrict or alert on endpoint traffic to `api.mainnet.solana.com` where there is no business justification. ### P3 — within 7 days - Enforce application control (WDAC or equivalent) to prevent execution from `%ProgramData%` and from user download directories. - Block or remove torrent clients from corporate endpoints; reinforce acceptable-use policy covering pirated media on corporate devices. - Maintain detection coverage for new modules — the framework is self-contained, modular and in-memory, and is assessed as reusable in later campaigns with minimal rework. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------------- | -------------------------------------------------------- | ------------------------------------------ | -------------------- | | md5 | A0B13781EDD7CFDAB13D79AFFF3C83C1 | High — explicitly tied to the loader | Kaspersky SecureList | | md5 | 4334BBAEA8DE33BF9D45E9B4E4E3BC2 | Medium — listed without per-file mapping | Kaspersky SecureList | | md5 | 4843F9FAFCAE492F11E2D4D33DBB4CDD | Medium — listed without per-file mapping | Kaspersky SecureList | | md5 | 5310CABAE3FBE6DB8742849B588093F9 | Medium — listed without per-file mapping | Kaspersky SecureList | | md5 | 70060341CAF3338697A7DDFE0FB62875 | Medium — listed without per-file mapping | Kaspersky SecureList | | md5 | AD4643EEA15AC286FA47D1131F9EF756 | Medium — listed without per-file mapping | Kaspersky SecureList | | md5 | D0B967571AC8A3863C7F324BF5BDE99C | Medium — listed without per-file mapping | Kaspersky SecureList | | md5 | D88D550D0FB8E60CFFFF3EA61FF7A067 | Medium — listed without per-file mapping | Kaspersky SecureList | | domain | deadhub\[.\]org | High — stage-1 C2 | Kaspersky SecureList | | ipv4 | 193.23.118\[.\]155 | High — stage-1 C2 fallback (plain HTTP) | Kaspersky SecureList | | ipv4 | 208.64.33\[.\]90 | High — stage-2 C2 | Kaspersky SecureList | | ipv4 | 208.94.246\[.\]53 | High — stage-2 C2 | Kaspersky SecureList | | domain | itorrents\[.\]org | High — compromised distribution repository | Kaspersky SecureList | | uri-path | /cloud/v192.4/ui/sync-status-icons.png | High — observed stage-1 request path | Kaspersky SecureList | | uri-path | /cloud/v192.4/onboarding/welcome-bg.jpg | High — observed stage-1 request path | Kaspersky SecureList | | uri-path | /cloud/v192.4/ui/file-preview-placeholder.png | High — observed stage-1 request path | Kaspersky SecureList | | uri-path | /cloud/v192.4/shared/link-banner.jpg | High — observed stage-1 request path | Kaspersky SecureList | | mutex | Global\\fnulSktzSqvVLXHU | Medium — randomly generated per sample | Kaspersky SecureList | | mutex | Global\\E4AyDKzvEhe2hgAr | Medium — randomly generated per sample | Kaspersky SecureList | | filepath | %ProgramData%\\Microsoft\\Windows\\Telemetry\\msedge.exe | High — persistence masquerade path | Kaspersky SecureList | | solana-account | 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm | High — stage-2 C2 address store | Kaspersky SecureList | | solana-program | CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL | High — program used to store C2 data | Kaspersky SecureList | ```iocs md5 A0B13781EDD7CFDAB13D79AFFF3C83C1 md5 4334BBAEA8DE33BF9D45E9B4E4E3BC2 md5 4843F9FAFCAE492F11E2D4D33DBB4CDD md5 5310CABAE3FBE6DB8742849B588093F9 md5 70060341CAF3338697A7DDFE0FB62875 md5 AD4643EEA15AC286FA47D1131F9EF756 md5 D0B967571AC8A3863C7F324BF5BDE99C md5 D88D550D0FB8E60CFFFF3EA61FF7A067 domain deadhub[.]org ipv4 193.23.118[.]155 ipv4 208.64.33[.]90 ipv4 208.94.246[.]53 domain itorrents[.]org uri-path /cloud/v192.4/ui/sync-status-icons.png uri-path /cloud/v192.4/onboarding/welcome-bg.jpg uri-path /cloud/v192.4/ui/file-preview-placeholder.png uri-path /cloud/v192.4/shared/link-banner.jpg mutex Global\fnulSktzSqvVLXHU mutex Global\E4AyDKzvEhe2hgAr filepath %ProgramData%\Microsoft\Windows\Telemetry\msedge.exe solana-account 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm solana-program CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------- | ---------------------------------------------- | ------------------------------- | | Global mutex creation with a random string component | EDR / Sysmon (handle creation), memory strings | Medium — values vary per sample | | Manual DLL parsing and function-address resolution without LoadLibrary/GetProcAddress | EDR API telemetry, memory forensics | High | | RWX memory allocation followed by raw NtProtectVirtualMemory syscall via 0x0F 0x05 in ntdll | EDR kernel telemetry, memory forensics | High | | Execution via undocumented ntdll function EtwpCreateEtwThread instead of CreateThread | EDR API telemetry | High | | Vectored exception handler registered and its address rewritten in memory | Memory forensics | High | | Process respawn with a command-line argument that skips anti-sandbox checks | Process creation logs | High | | Beacon containing a flag indicating execution from the Telemetry folder | Network / C2 traffic analysis | High | | HTTPS to a TLS-pinned C2 carrying nanopb protobuf payloads | Network / TLS metadata | High | | HTTPS requests to Solana /getAccountInfo for the account listed above | Proxy / DNS / network logs | High | ## 6\. Detection **Caveat on the YARA rule below:** stage-1 strings are encrypted on disk with a custom stream cipher, so this rule is most effective against memory images, unpacked modules and decrypted stage-2/3 artefacts rather than the raw loader file. The mutex strings are randomly generated per sample and will not generalise — they are included because they are genuine artefacts, not because they are durable. ```yara rule Crimeware_MovieReaper_Artefacts { meta: author = "Adverse Trace" date = "2026-09-17" reference = "https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/" description = "Detects plaintext MovieReaper stage-1/stage-2 artefacts. Stage-1 strings are encrypted on disk with a custom stream cipher; best used against memory images and unpacked modules." tlp = "AMBER" strings: $p1 = "/cloud/v192.4/ui/sync-status-icons.png" ascii $p2 = "/cloud/v192.4/onboarding/welcome-bg.jpg" ascii $p3 = "/cloud/v192.4/ui/file-preview-placeholder.png" ascii $p4 = "/cloud/v192.4/shared/link-banner.jpg" ascii $d1 = "deadhub.org" ascii $i1 = "193.23.118.155" ascii $s1 = "6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm" ascii $s2 = "CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL" ascii $m1 = "Global\\fnulSktzSqvVLXHU" ascii $m2 = "Global\\E4AyDKzvEhe2hgAr" ascii $f1 = "Telemetry\\msedge.exe" ascii condition: 3 of them } ``` ```yaml title: MovieReaper Persistence Masquerade - Execution from Fake Telemetry Path status: experimental description: Detects execution of a binary masquerading as msedge.exe from the MovieReaper persistence path under ProgramData. references: - https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/ author: Adverse Trace date: 2026-09-17 logsource: category: process_creation product: windows detection: selection: Image|endswith: '\Microsoft\Windows\Telemetry\msedge.exe' condition: selection falsepositives: - None expected; legitimate Microsoft Edge does not execute from this path. level: critical ``` ```yaml title: MovieReaper Stage-1 and Stage-2 C2 Network Connection status: experimental description: Detects network connections to MovieReaper first- and second-stage C2 infrastructure. Apply the same address list to DNS and proxy logs for deadhub.org. references: - https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/ author: Adverse Trace date: 2026-09-17 logsource: category: network_connection product: windows detection: selection_ip: DestinationIp: - '193.23.118.155' - '208.64.33.90' - '208.94.246.53' condition: selection_ip falsepositives: - None expected. level: critical ``` ## 7\. Sources - Kaspersky SecureList — "The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents" — https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/ — 2026-09-17 - Kaspersky SecureList — "MovieReaper: Trojan attack via movie torrents, including 'The Odyssey'" — https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/ — 2026-09-17 ## 8\. Adverse Trace position --- [Read the original source →](https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*