[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fo6GomdcIzBWovzBHn5k1pP57rqsAMWWJCHCkQK-JF-0":3},{"article":4,"iocs":38,"watch_terms":43,"solutions":44,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"18cc4a76-bb9a-4821-ae9c-ecb2e156884c","The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents","the-odyssey-and-trojans-again-moviereaper-attacks-users-in-multiple-countries-vi-9e0dd1","Kaspersky experts have discovered a new MovieReaper campaign. The multi-stage Trojan spreads through movie torrents, such as \"The Odyssey,\" and uses the Solana blockchain to hide its C2 infrastructure.","Kaspersky has uncovered a new MovieReaper campaign where a multi-stage Trojan is distributed through compromised torrent files, disguised as popular movies like 'The Odyssey.' The malware leverages the Solana blockchain for its command and control (C2) infrastructure, making it harder to track. The campaign has affected hundreds of victims globally, including both individuals and organizations.","MovieReaper campaign uses compromised torrents to distribute multi-stage Trojan with Solana C2 infrastructure.","https:\u002F\u002Fsecurelist.com\u002Fmoviereaper-malware-torrent-odyssey-solana\u002F121344\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F09\u002F17114657\u002FOdyssey-and-trojans-again-scaled.jpg","2026-09-17T13:00:53+00:00","2026-09-17T14:00:25.047369+00:00",8,[17],{"name":18,"type":19},"Solana blockchain","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39],{"type":40,"value":41,"context":42},"domain","itorrents.org","Compromised torrent file repository used for distribution.",[],{"controls":45,"vendors":127},[46,75,104],{"slug":47,"name":48,"problem":49,"products":50},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":76,"name":77,"problem":78,"products":79},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"slug":105,"name":106,"problem":107,"products":108},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[109,114,121],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":110,"product_name":111,"url":112,"description":113},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":115,"product_name":118,"url":119,"description":120},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":122,"product_name":123,"url":125,"description":126},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":143},"moviereaper-trojan-spreads-via-compromised-torrents-using-blockchain-c2","MovieReaper Trojan Spreads via Compromised Torrents Using Blockchain C2","The MovieReaper campaign exploits users who download pirated content from torrent platforms, embedding a multi-stage Trojan inside files disguised as popular movies. By leveraging the Solana blockchain as its command and control infrastructure, the attackers made detection and takedown significantly harder for security teams. This highlights how threat actors exploit both user trust in informal distribution channels and novel technologies to evade traditional defenses. The campaign's global reach across both individuals and organizations underscores that risky personal downloading behaviors can have serious enterprise-level consequences.",[133,134,135,136,137,138,139,140,141,142],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 AT-2 – Security Awareness Training","NIST CSF DE.CM-1 – Network Communications Monitoring","MITRE ATT&CK T1102 – Web Service C2 (Blockchain variant)","MITRE ATT&CK T1204 – User Execution: Malicious File","GDPR Article 32 – Security of Processing (for affected EU organizations)",{"NIST SP 800-53 SC-7 – Boundary Protection":144,"CIS Control 13 – Network Monitoring and Defense":145,"NIST SP 800-53 SI-3 – Malicious Code Protection":146,"CIS Control 9 – Email and Web Browser Protections":147,"NIST SP 800-53 AT-2 – Security Awareness Training":148,"MITRE ATT&CK T1204 – User Execution: Malicious File":149,"NIST CSF DE.CM-1 – Network Communications Monitoring":150,"CIS Control 2 – Inventory and Control of Software Assets":151,"MITRE ATT&CK T1102 – Web Service C2 (Blockchain variant)":152,"GDPR Article 32 – Security of Processing (for affected EU organizations)":153},"Boundary protection can block or alert on connections to blockchain services that the malware uses for command and control.","Network monitoring helps detect blockchain-based command and control traffic from infected machines.","Malicious code protection helps detect the multi-stage Trojan hidden in files disguised as movies.","Browser and download protections help block malicious files from torrent sites before they are opened.","Awareness training warns users that pirated downloads are a common malware delivery route.","Users executing files disguised as movies is user execution of a malicious file, which awareness and execution controls address.","Monitoring network communications can reveal infected hosts contacting Solana nodes unexpectedly.","Controlling which software can be installed reduces the chance users run pirated files carrying MovieReaper.","Using the Solana blockchain for command and control is a web service channel that is hard to take down, so detection must focus on endpoint behaviour.","Organisations with infected endpoints must protect personal data against malware like MovieReaper."]