The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents

1. Executive summary

A previously unknown modular, multi-stage Windows crimeware framework — dubbed MovieReaper — has been distributed at scale since mid-August 2026 through malicious torrent files served by the compromised public torrent repository itorrents[.]org, which downstream trackers rely on. Kaspersky reports several hundred victims, both individuals and organisations, across Europe (Spain, Netherlands, Belgium, Germany, Finland), Asia and Africa; targeted sectors include enterprise, government, IT, consulting, retail, transportation and agriculture. No CVE is associated with this campaign and no verified CVSS or CISA KEV data applies — the vector is user-executed pirated media, not a software vulnerability. The bottom-line risk to EMEA financial services is concentrated and specific: any corporate Windows endpoint where a user runs pirated film or software content is a viable entry point, and the final-stage module grants the operator full filesystem read/write and file-preview exfiltration over 21 commands. All technical detail in this advisory is single-sourced to Kaspersky SecureList; no second vendor has corroborated the framework, its infrastructure or its victim counts.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The campaign's distribution vector is consumer piracy infrastructure (itorrents[.]org and public torrent trackers), which is not an ICT third-party provider relationship under DORA Art. 28–30, and no incident at a client is established by the source material. If a client independently confirms MovieReaper on an in-scope production asset, DORA Art. 17 (ICT-related incident management process), Art. 18 (classification of ICT-related incidents and cyber threats) and Art. 19 (reporting of major ICT-related incidents to competent authorities) would be engaged by that confirmed incident — not by this advisory.

3. Technical analysis & attack chain

Confirmed attack chain

1. Distribution. The threat actor compromised itorrents[.]org, a widely used public repository of torrent files — not the individual trackers. Trackers that source torrent files from this repository began serving malicious torrents to their users. When a user requests a torrent via a magnet link, the archive returns a different torrent file than the one requested; that torrent leads to download of the MovieReaper loader. The archive remained compromised as of the report's publication date.
2. Execution. The user manually launches the downloaded executable. Observed filenames are deliberately long to push the .exe extension out of view, e.g. the odyssey (2026) [1080p] [webrip] [5.1].exe, and the binary carries the icon of a well-known application. Multiple loader variants were observed; the most widely distributed sample had MD5 A0B13781EDD7CFDAB13D79AFFF3C83C1, identical across all downloads.
3. Single-instance guard. The loader creates a global mutex to ensure only one instance runs. Observed values include Global\fnulSktzSqvVLXHU and Global\E4AyDKzvEhe2hgAr; the string component is randomly generated per sample.
4. Anti-sandbox / API resolution. The loader avoids LoadLibrary and GetProcAddress. It walks the double-linked list from the Ldr field of the PEB to locate loaded libraries, then manually parses the DLL to compute the address of each required function.
5. Stage-1 C2 and shellcode delivery. The loader decodes the domain deadhub[.]org and connects over HTTPS; if that fails it falls back to http://193.23.118[.]155 over plain HTTP. It selects a random group of strings to use as the request path and downloads shellcode in parts. Observed paths: - /cloud/v192.4/ui/sync-status-icons.png - /cloud/v192.4/onboarding/welcome-bg.jpg - /cloud/v192.4/ui/file-preview-placeholder.png - /cloud/v192.4/shared/link-banner.jpg
6. In-memory execution. The shellcode is mapped into RWX memory and executed. The loader registers a vectored exception handler and rewrites the handler address in memory so that a debug break does not crash the process but redirects control flow into a function that issues a raw NtProtectVirtualMemory syscall via the 0x0F 0x05 syscall instruction previously located inside ntdll. It then calls the undocumented ntdll function EtwpCreateEtwThread — a known alternative to CreateThread — to execute the shellcode.
7. Stage-2 C2 resolution via Solana. The second stage issues an HTTPS request to the Solana blockchain /getAccountInfo endpoint for account 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm. The data field of the response contains the base64-encoded address of the second-stage C2, encrypted with a static XOR key embedded in the shellcode. Data is stored in that account via a simple Solana program at CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL. This gives the operator decentralised, takedown-resistant C2 address storage.
8. Stage-2 implant. Communicates with its C2 strictly over HTTPS with a TLS-pinned certificate, using the nanopb protobuf library as the data container. Its primary initial command parses a COFF file, loads it into memory and executes its module_init function — an extensible interface for adding commands. Recovered modules were compiled with symbols, which accelerated reverse engineering.
9. Stage-3 persistence and UAC bypass. The loaded module performs UAC bypass and establishes persistence using public techniques, masquerades the binary as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe, and restarts itself.
10. Respawn. The respawned process re-runs the initial loader with a special command-line argument that skips most anti-sandbox checks and proceeds directly to the stage-2 download. The beacon includes a flag indicating whether the implant is running from the Telemetry folder, letting the C2 distinguish first-run from respawned instances.
11. Final module — file manager. Exposes 21 commands giving the operator filesystem access on the victim host: download, upload and read files; list and enumerate directories; create, copy, rename, move, delete, chmod and symlink operations; and preview/thumbnail commands that exfiltrate previews of images and files before the operator extracts them. Additional modules are suspected to be loaded on demand.

Technical notes for defenders

• Only the first stage touches disk. Everything after the loader is in-memory, which is why the persistence artefact at C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe is the highest-value host indicator.
• Obfuscation is limited. The malware is not heavily obfuscated apart from a custom stream cipher applied to strings. Most countermeasures target AV sandbox evasion rather than static analysis.
• C2 infrastructure uses various commercial hosting providers. The Solana RPC endpoint used is the legitimate api.mainnet.solana.com; blocking it outright is not advisable, but endpoint use of it is anomalous in most corporate estates.
• Disruption point. The first stage depends on a single domain and a single IP to serve shellcode; taking down that server breaks the chain. The second stage, anchored in Solana, is materially harder to disrupt.
• Actor history. The same actor's activity is traced back to October 2025, with the loader progressively hardened while the pattern (encoded strings, shellcode delivered over plain HTTP, sandbox/VM evasion) stayed constant.

Confidence caveats

This entire section is single-sourced to Kaspersky SecureList; no independent vendor has corroborated the framework, the itorrents[.]org compromise, the victim counts or the country list. The source does not name the actor and provides no MITRE ATT&CK group profile — attribution is therefore unconfirmed and no actor name should be used in reporting. The eight MD5 values in §5 are published as a flat list without per-file mapping; only A0B13781EDD7CFDAB13D79AFFF3C83C1 is explicitly tied to the loader. The mutex values are randomly generated per sample and will not generalise.

4. Mitigation & containment

There is no vendor patch for this item — it is malware, not a vulnerability. Remediation for a confirmed host is reimage, not cleaning, because the post-loader stages execute entirely in memory.

P1 — within 24 hours

• Block egress at DNS, proxy and firewall to deadhub[.]org, 193.23.118[.]155, 208.64.33[.]90 and 208.94.246[.]53. Note the stage-1 fallback is plain HTTP, so this leg is visible without TLS inspection.
• Hunt all Windows endpoints for C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe. Legitimate Microsoft Edge does not execute from this path. On a hit: isolate the host, capture memory, then reimage.
• Confirm AV/EDR coverage for the Kaspersky detection name HEUR:Trojan.Win64.Agent.gen and push current signatures.
• Block itorrents[.]org at the web proxy — the repository was still serving malicious torrent files at publication.
• Alert on any endpoint resolving deadhub[.]org or initiating connections to the four IPs above.

P2 — within 72 hours

• Retro-hunt proxy, DNS and firewall logs back to mid-August 2026 (campaign start) for the four stage-1 URI paths, the C2 domain and the four IPs. Extend to October 2025 if the actor's earlier activity is in scope.
• Review EDR telemetry for the injection chain: RWX memory allocation, raw NtProtectVirtualMemory syscalls, EtwpCreateEtwThread calls, and vectored-exception-handler manipulation.
• Force credential reset for any user with confirmed loader execution — the file-manager module provides full filesystem read access, so credential material on disk must be treated as exposed.
• Restrict or alert on endpoint traffic to api.mainnet.solana.com where there is no business justification.

P3 — within 7 days

• Enforce application control (WDAC or equivalent) to prevent execution from %ProgramData% and from user download directories.
• Block or remove torrent clients from corporate endpoints; reinforce acceptable-use policy covering pirated media on corporate devices.
• Maintain detection coverage for new modules — the framework is self-contained, modular and in-memory, and is assessed as reusable in later campaigns with minimal rework.

5. Indicators of compromise

md5  A0B13781EDD7CFDAB13D79AFFF3C83C1
md5  4334BBAEA8DE33BF9D45E9B4E4E3BC2
md5  4843F9FAFCAE492F11E2D4D33DBB4CDD
md5  5310CABAE3FBE6DB8742849B588093F9
md5  70060341CAF3338697A7DDFE0FB62875
md5  AD4643EEA15AC286FA47D1131F9EF756
md5  D0B967571AC8A3863C7F324BF5BDE99C
md5  D88D550D0FB8E60CFFFF3EA61FF7A067
domain  deadhub[.]org
ipv4  193.23.118[.]155
ipv4  208.64.33[.]90
ipv4  208.94.246[.]53
domain  itorrents[.]org
uri-path  /cloud/v192.4/ui/sync-status-icons.png
uri-path  /cloud/v192.4/onboarding/welcome-bg.jpg
uri-path  /cloud/v192.4/ui/file-preview-placeholder.png
uri-path  /cloud/v192.4/shared/link-banner.jpg
mutex  Global\fnulSktzSqvVLXHU
mutex  Global\E4AyDKzvEhe2hgAr
filepath  %ProgramData%\Microsoft\Windows\Telemetry\msedge.exe
solana-account  6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm
solana-program  CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL

Behavioural indicators

6. Detection

Caveat on the YARA rule below: stage-1 strings are encrypted on disk with a custom stream cipher, so this rule is most effective against memory images, unpacked modules and decrypted stage-2/3 artefacts rather than the raw loader file. The mutex strings are randomly generated per sample and will not generalise — they are included because they are genuine artefacts, not because they are durable.

rule Crimeware_MovieReaper_Artefacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-17"
        reference = "https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/"
        description = "Detects plaintext MovieReaper stage-1/stage-2 artefacts. Stage-1 strings are encrypted on disk with a custom stream cipher; best used against memory images and unpacked modules."
        tlp = "AMBER"

    strings:
        $p1 = "/cloud/v192.4/ui/sync-status-icons.png" ascii
        $p2 = "/cloud/v192.4/onboarding/welcome-bg.jpg" ascii
        $p3 = "/cloud/v192.4/ui/file-preview-placeholder.png" ascii
        $p4 = "/cloud/v192.4/shared/link-banner.jpg" ascii
        $d1 = "deadhub.org" ascii
        $i1 = "193.23.118.155" ascii
        $s1 = "6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm" ascii
        $s2 = "CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL" ascii
        $m1 = "Global\\fnulSktzSqvVLXHU" ascii
        $m2 = "Global\\E4AyDKzvEhe2hgAr" ascii
        $f1 = "Telemetry\\msedge.exe" ascii

    condition:
        3 of them
}

title: MovieReaper Persistence Masquerade - Execution from Fake Telemetry Path
status: experimental
description: Detects execution of a binary masquerading as msedge.exe from the MovieReaper persistence path under ProgramData.
references:

  - https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/
author: Adverse Trace
date: 2026-09-17
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\Microsoft\Windows\Telemetry\msedge.exe'
  condition: selection
falsepositives:

  - None expected; legitimate Microsoft Edge does not execute from this path.
level: critical

title: MovieReaper Stage-1 and Stage-2 C2 Network Connection
status: experimental
description: Detects network connections to MovieReaper first- and second-stage C2 infrastructure. Apply the same address list to DNS and proxy logs for deadhub.org.
references:

  - https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/
author: Adverse Trace
date: 2026-09-17
logsource:
  category: network_connection
  product: windows
detection:
  selection_ip:
    DestinationIp:

      - '193.23.118.155'
      - '208.64.33.90'
      - '208.94.246.53'
  condition: selection_ip
falsepositives:

  - None expected.
level: critical

7. Sources

• Kaspersky SecureList — "The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents" — https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/ — 2026-09-17
• Kaspersky SecureList — "MovieReaper: Trojan attack via movie torrents, including 'The Odyssey'" — https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/ — 2026-09-17

8. Adverse Trace position

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.