Loading story…
A previously unknown modular crimeware framework, MovieReaper, was distributed through malicious torrent files masquerading as popular films—including The Odyssey—after attackers compromised the public torrent-file repository itorrents.org. Active since at least October 2025 and identified in mid-August 2026, the campaign has affected individual and organizational victims across Europe, Asia, Africa, and other regions without requiring the attackers to compromise each torrent tracker directly.
The Trojan uses sandbox evasion and in-memory shellcode execution, initially retrieving payloads from deadhub.org or fallback address 193.23.118.155. It obtains an encrypted second-stage C2 address through the Solana blockchain, downloads COFF modules over HTTPS using certificate pinning, bypasses UAC, and persists as a fake msedge.exe telemetry process. Its final known modules enable broad filesystem operations and prepare data for exfiltration; blocking the identified first-stage infrastructure may interrupt infections before they transition to the more resilient blockchain-mediated C2 chain.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers identified and named the previously unknown MovieReaper modular crimeware campaign. The campaign had affected individual and organizational victims across Europe, Asia, and Africa, including government, IT, retail, transportation, and agriculture sectors.
Researchers linked MovieReaper activity to the same unidentified threat actor and traced it back to October 2025.
Attackers compromised the public itorrents.org torrent-file repository, causing trackers that relied on it to serve malicious torrents disguised as films, games, and other pirated content. The downloaded executables initiated the multi-stage MovieReaper infection chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcesecurelist.com
Open sourcesecurelist.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a malware campaign delivering a modified **SilentCryptoMiner** alongside a remote access trojan through illegal movie, TV, and digital library websites that pushed fake video player plugin updates. The infection chain used a ZIP archive containing a legitimate executable and a malicious DLL for **DLL side-loading**, then triggered stack-overflow-based ROP decryption and reflective loading to deploy the main module, a watchdog component, the RAT, and CPU/GPU miners. The activity appears to extend operations seen since at least 2022, with refreshed infrastructure and delivery sites but largely unchanged archive structure and execution logic. The malware used **DNS tunneling** and date-based domain generation for execution gating and command-and-control, disabled security and power-saving features when it gained elevated privileges, and established persistence through a fake `GoogleUpdateTaskMachineQC` service; researchers said the campaign had substantial exposure because the affected piracy-related sites drew roughly **40 million visits** in April 2026.
Jun 29, 2026
ESET disclosed **KryptoCibule**, a previously undocumented malware family active since at least late 2018 that primarily targeted users in **Czechia and Slovakia** through malicious torrents posing as cracked software installers. The malware combined several cryptocurrency-focused functions: it mined coins on infected systems, monitored the clipboard to replace copied wallet addresses and redirect payments, searched for cryptocurrency wallets and related files for exfiltration, and also exposed **remote-access trojan (RAT)** capabilities. The campaign relied heavily on **Tor** and **BitTorrent** infrastructure and either bundled or fetched legitimate tools including **Tor**, **Transmission**, **Apache httpd**, and **Buru SFTP Server** to support command-and-control and data theft through onion services hosted on compromised machines. ESET said KryptoCibule used layered evasion and persistence measures, including obfuscation, masquerading as Adobe Reader components, scheduled tasks, Windows Defender exclusions, firewall rule changes, and checks for analysis tools and antivirus products; although only hundreds of victims were observed, the malware remained active and continued to gain new capabilities.
Aug 15, 2026
Scammers rapidly exploited interest in Christopher Nolan’s *The Odyssey* by launching cloned piracy sites that targeted users searching for unauthorized copies of the film. Researchers said the campaign used coordinated pages that copied torrent listings, artwork, and cast details, then displayed fake browser warnings claiming a missing component and urging visitors to click a **“Fix It Now”** prompt. Those prompts redirected victims into malvertising chains that could lead to fake browser extensions, scareware, and other malicious content. A second lure offered what appeared to be a movie download but was actually a Windows executable disguised as a video file, using a movie-style filename, misleading metadata, and a VLC Media Player icon to look legitimate. The activity relied on social engineering rather than software exploits, with likely outcomes including **Trojans**, **infostealers**, **loaders**, and potentially **ransomware** if users ran the file. Researchers warned that a supposed movie ending in `.exe` is a strong sign of malware and advised affected users to scan systems, disconnect compromised devices, and change passwords from a trusted device.
Jul 22, 2026