MovieReaper Malware Poisons Torrents, Uses Solana for C2

Key Takeaways

• A new Windows malware, MovieReaper, is being distributed through poisoned movie torrents.
• The malware employs sophisticated evasion techniques, including in-memory execution and User Account Control (UAC) bypasses.
• MovieReaper uniquely leverages the Solana blockchain for command-and-control (C2) server discovery, enhancing its resilience against takedowns.
• The campaign has impacted hundreds of victims across various sectors and geographies, highlighting the broad reach of compromised torrent distribution.
• Defenders should block identified indicators of compromise (IoCs) and exercise extreme caution with unverified software downloads.

MovieReaper Malware Spreads Through Compromised Torrents

A novel Windows malware framework, dubbed MovieReaper, is actively compromising systems by infecting popular movie torrent downloads. Threat actors are manipulating torrent files for widely sought-after films, transforming seemingly innocuous entertainment searches into vectors for remote access and data exfiltration. This campaign has successfully infiltrated users and organizations across numerous countries, with victims unknowingly downloading malicious torrent files when attempting to acquire legitimate movie content via magnet links.

Upon download, the altered file presents itself as a media release, often featuring an extended filename designed to obscure its executable extension (e.g., “the odyssey (2026) [1080p] [webrip] [5.1].exe”). Once executed, this disguised loader initiates a multi-stage compromise process that predominantly operates in memory, making detection more challenging.

Analysts suggest that the malicious activity stems from compromised storage utilized by torrent trackers, rather than direct breaches of individual tracker sites. This strategic approach allows the attackers to disseminate MovieReaper across multiple torrent services from a single compromised repository. According to Securelist said in a report, investigators have identified hundreds of victims, spanning Europe, Asia, and Africa. Affected entities include private users and organizations within government, IT, retail, transportation, consulting, and agriculture sectors. This wide array of targets underscores the persistent threat posed by poisoned downloads, where a single compromised distribution point can expose a diverse user base, irrespective of which specific torrent website they frequent. Early campaign observations revealed infections in countries such as Russia, Türkiye, Japan, Kenya, Uganda, Colombia, Spain, the Netherlands, Belgium, and Germany.

Sophisticated Evasion and Multi-Stage Infection

The initial MovieReaper loader, identified by an MD5 hash like A0B13781EDD7CFDAB13D79AFFF3C83C1, employs a familiar application icon and an intentionally lengthy filename to mask its .exe extension, leveraging social engineering to trick users into executing what appears to be video content.

Before establishing contact with its command-and-control (C2) infrastructure, the loader incorporates several anti-analysis techniques. It avoids common Windows API calls, utilizes a vectored exception handler, and executes subsequent components entirely in memory to thwart automated detection. This evasive behavior mirrors other advanced threats that employ techniques like Windows UAC bypasses and trusted-looking Windows paths to reduce suspicion.

MovieReaper then connects to a first-stage server for shellcode, using a primary domain (e.g., deadhub[.]org) and a fallback IP address (e.g., 193.23.118[.]155). The payload retrieves additional code in small fragments, cleverly disguised as innocuous cloud-service image paths (e.g., /cloud/v192.4/ui/sync-status-icons.png). For persistence, the malware installs itself in a location mimicking Windows telemetry (e.g., %ProgramData%MicrosoftWindowsTelemetrymsedge.exe), bypasses User Account Control (UAC), and restarts to maintain access across user sessions.

The final module grants attackers extensive control over compromised files, enabling operations such as reading, uploading, downloading, renaming, moving, and deleting. It also possesses the capability to create file previews and thumbnails, allowing operators to selectively target valuable data. This modular architecture permits the delivery of additional capabilities on demand, as determined by the attackers.

Solana Blockchain for Resilient C2

A particularly noteworthy aspect of this campaign is its innovative use of the Solana blockchain to dynamically locate a subsequent command-and-control server. The shellcode queries a specific Solana account (e.g., 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm) via Solana’s getAccountInfo endpoint. It then decodes an encrypted C2 address embedded within the returned blockchain data. This method significantly enhances the communication path’s resilience, making it far more challenging to disrupt compared to traditional fixed server lists. While blockchain-based control does not render the malware invisible, it complicates takedown efforts, as attackers can update destination information without relying on a single, easily identifiable website. Similar tactics have been observed in campaigns like the Developer-targeting Glassworm malware, which also utilized Solana for instruction distribution, demonstrating a growing trend of cybercriminals leveraging public blockchain services for operational robustness.

MovieReaper’s second-stage component communicates via HTTPS with a pinned certificate and can load additional modules directly into memory. Researchers indicate that the threat actor’s activity dates back to October 2025, with continuous evolution aimed at making the loader increasingly difficult to detect. This sophisticated approach, combining in-memory execution, privilege escalation bypasses, and decentralized C2, echoes the resilience observed in other advanced threats like PHANTOMPULSE blockchain C2 analysis.

What You Should Do

• Block IoCs: Immediately implement blocking rules for all provided Indicators of Compromise (IoCs) in your network security devices, including firewalls, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) solutions.
• Investigate Unusual Downloads: Proactively scan and investigate any systems where torrent downloads are observed, especially if they are not part of approved corporate policies.
• Review Suspicious Executions: Maintain vigilance over suspicious executable files, particularly those with unusual filenames or extensions, and analyze their behavior for signs of compromise.
• Avoid Pirated Software: Strictly prohibit the download and execution of pirated software, including movies, games, and applications, as these are common vectors for malware distribution.
• Never Disable Protections: Educate users never to disable security software (antivirus, EDR) to run unverified installers on personal or corporate devices.
• Verify Software Sources: Always obtain software from official, trusted vendors and verified sources to mitigate supply chain risks, as demonstrated by the Solana FakeFix supply-chain campaign.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.