The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents
MovieReaper campaign uses compromised torrents to distribute multi-stage Trojan with Solana C2 infrastructure.
Kaspersky has uncovered a new MovieReaper campaign where a multi-stage Trojan is distributed through compromised torrent files, disguised as popular movies like 'The Odyssey.' The malware leverages the Solana blockchain for its command and control (C2) infrastructure, making it harder to track. The campaign has affected hundreds of victims globally, including both individuals and organizations.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe MovieReaper campaign exploits users who download pirated content from torrent platforms, embedding a multi-stage Trojan inside files disguised as popular movies. By leveraging the Solana blockchain as its command and control infrastructure, the attackers made detection and takedown significantly harder for security teams. This highlights how threat actors exploit both user trust in informal distribution channels and novel technologies to evade traditional defenses. The campaign's global reach across both individuals and organizations underscores that risky personal downloading behaviors can have serious enterprise-level consequences.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — itorrents.org