The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through compromised torrents

MovieReaper is a modular, multi-stage malware framework distributed through compromised torrent files on popular trackers, primarily via the repository itorrents[.]org. The initial loader, disguised as movie files, downloads shellcode from a C2 server and uses the Solana blockchain to retrieve the address of a second C2, enhancing resilience against takedowns. The malware performs UAC bypass and establishes persistence by masquerading as a legitimate Microsoft binary, ultimately deploying a final implant that provides remote file system access with 21 commands for exfiltration and manipulation. Victims span multiple countries and sectors, including enterprise, government, and retail.

AI-extracted · verify before operational use