[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fe6elqfh6pJCrCKkm3rJ7AIbAoq9bKCbppdqy4Q2p4qI":3},{"article":4,"iocs":42,"watch_terms":46,"solutions":47,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":29},"74831bdf-e9ee-4220-a328-9f40f5581875","MovieReaper Malware Uses The Odyssey Torrents to Infect Users Worldwide","moviereaper-malware-uses-the-odyssey-torrents-to-infect-users-worldwide-3f9028","MovieReaper malware spreads through compromised Odyssey torrents, infecting hundreds of victims while using Solana to locate command-and-control infrastructure.","A new malware strain, dubbed MovieReaper, is actively infecting users worldwide by distributing itself through compromised torrent files on the Odyssey platform. The malware leverages the Solana blockchain to obscure and locate its command-and-control (C2) infrastructure, making it harder for security researchers to track and disrupt. Hundreds of victims have already been identified.","MovieReaper malware spreads via compromised torrents, using Solana for C2 infrastructure.","https:\u002F\u002Fhackread.com\u002Fmoviereaper-malware-odyssey-torrents-infect-users\u002F",null,"2026-09-22T15:44:09+00:00","2026-09-22T16:01:01.587958+00:00",7,[17,20,22],{"name":18,"type":19},"Torrents","technology",{"name":21,"type":19},"Blockchain",{"name":23,"type":24},"Solana","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":12,"name":27,"slug":28},"Malware","malware",[30,35,37],{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":36},{"id":25,"icon":12,"name":27,"slug":28},{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[43],{"type":28,"value":44,"context":45},"MovieReaper","Name of the malware strain",[23],{"controls":48,"vendors":135},[49,78,106],{"slug":50,"name":51,"problem":52,"products":53},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":41,"name":79,"problem":80,"products":81},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":107,"name":108,"problem":109,"products":110},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":153},"moviereaper-malware-spreads-via-torrent-files-using-blockchain-obscured-c2","MovieReaper Malware Spreads via Torrent Files Using Blockchain-Obscured C2","MovieReaper highlights how threat actors exploit trusted-seeming distribution platforms — in this case, torrent sites — to deliver malware to unsuspecting users seeking pirated content. By leveraging the Solana blockchain as a decentralized command-and-control mechanism, the attackers make traditional domain takedown and IP blocking ineffective, significantly extending the malware's operational lifespan. This supply chain-style compromise of a content distribution platform means victims believe they are downloading legitimate files while inadvertently executing malicious payloads. The case underscores that user behavior — specifically downloading pirated or unverified content — remains one of the most exploitable attack vectors available to adversaries.",[141,142,143,144,145,146,147,148,149,150,151,152],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 CA-7: Continuous Monitoring","MITRE ATT&CK T1102: Web Service (C2 via Blockchain)","MITRE ATT&CK T1566: Phishing \u002F Malicious File Delivery","ISO\u002FIEC 27001 A.7.2.2: Information Security Awareness, Education and Training","GDPR Article 32: Security of Processing (for organizations handling EU user data affected by breach)",{}]