Kaspersky cybersecurity company has reported the identification of a complex, multi-stage cyber campaign called “MovieReaper” that uses torrent files of popular films, including Christopher Nolan’s film “Odissey,” to distribute malware among users and organizations in several countries. According to a report published on Kaspersky’s research platform Securelist, this campaign has been observed since mid-August 2026, although initial activity by the same threat actor dates back to October 2025.
Infection path: from a public repository to hundreds of victims
An important point in this campaign is its distribution method. Instead of compromising each torrent site individually, the attackers targeted a public repository of torrent files called itorrents.org, which is used by many trackers. By infiltrating this shared infrastructure, whenever a user requested to download a film via a magnet link, they received a malicious substituted version instead of the original torrent file. This method allowed the attackers to affect users of multiple different trackers simultaneously without tampering with each site separately.
The final downloaded file was presented with a long name related to the film in question; for example, one observed sample had a title resembling a web-rip version of the film “Odissey” in 1080p quality and ended with the executable extension exe. The long file name made its real extension easily hidden from the user’s view. According to Kaspersky, the campaign has so far left hundreds of victims in countries including Russia, Turkey, Japan, Kenya, Uganda, Colombia, Spain, the Netherlands, Belgium, Germany, and Finland, and has involved organizations in commercial, governmental, IT, consulting, retail, transportation, and agricultural sectors.
Detection evasion and persistence techniques
Technically, MovieReaper is a modular, multi-stage framework. Its first stage is a loader that, to evade sandbox environments, instead of calling common system functions directly, manually walks process memory structures and uses advanced techniques such as executing raw system instructions and using undocumented Windows functions to remain hidden from antivirus software. After activation, this loader retrieves the next stage malicious code from a preconfigured domain and IP address.
In later stages, the malware gains the ability to bypass Windows User Account Control (UAC) and, for persistence, stores a copy of itself with a name similar to Microsoft Edge files (msedge.exe) in the system’s application data path; an action that makes it harder for ordinary users to detect. Experts have warned that the presence of such a file in unusual system paths should not be mistaken for the legitimate Edge browser files.
The role of the Solana blockchain in hiding the command infrastructure
Perhaps the campaign’s most notable feature is the use of the Solana blockchain to manage command-and-control (C2) infrastructure. In one stage, the malware queries the details of a specific account via standard Solana services; the data, which is stored encrypted and encoded on the blockchain, is decrypted to reveal the address of the next-stage command server to the malware.
This method gives the attackers a significant advantage: while security teams can block a known domain or IP address, the attackers can simply update the data stored in their blockchain account to supply a new server address to the malware already installed on infected devices, without changing the malware code. This feature makes identifying and fully dismantling the attack infrastructure considerably more difficult for security researchers.
Full access to victim files in the final stage
The final link in this infection chain is the installation of a module called “file manager” that allows attackers to remotely gain full access to files stored on the victim’s device using dozens of predefined commands, including reading, copying, moving, renaming, and deleting files. Such a level of control effectively means unlimited access for the attacker to personal and organizational information stored on the infected computer.
Kaspersky’s security recommendations
Kaspersky has explicitly warned that downloading files from untrusted torrent sources, even if they appear to be merely entertainment content like a movie, can be a gateway to compromising devices and organizational networks. The company recommends that users who have recently run an executable file presented as a film should promptly perform a full security scan on their system and check for suspicious files in unusual system paths. According to Securelist, the campaign remains active and the compromised repository has not yet been fully cleaned.
Given the modular nature of this framework and its ability to execute directly in system memory without leaving many traces on disk, security experts believe components of this malware may be reused in future campaigns with minor modifications; a matter that underscores the importance of basic cybersecurity practices, including avoiding downloads from unofficial sources and carefully checking file extensions of downloaded files.