MovieReaper Multi-Stage Trojan Campaign

MovieReaper is a sophisticated multi-stage modular Trojan framework identified in August 2026. The campaign primarily spreads by abusing the itorrents.org repository, which serves malicious torrent files disguised as popular media, such as the film "The Odyssey." The malware is designed to evade sandbox analysis through manual PEB-based library resolution and syscall-driven shellcode execution. Notably, the framework uses the Solana blockchain to dynamically resolve secondary C2 infrastructure, enhancing resilience against takedown efforts. Once deployed, the malware performs UAC bypasses and establishes persistence by masquerading as Microsoft telemetry components in the C:\ProgramData\Microsoft\Windows\Telemetry\ directory. The modular architecture allows the threat actors to deploy additional capabilities via COFF file injection.

Attack Chain

1. User downloads a malicious torrent file originating from the compromised itorrents.org repository.
2. Execution of the dropper (e.g., "the odyssey (2026).exe") which uses an anti-debugging mutex (e.g., Global\fnulSktzSqvVLXHU) and manual PEB parsing to locate system functions.
3. Dropper initiates an HTTPS connection to deadhub.org or the fallback 193.23.118.155 to download encrypted shellcode.
4. Execution of the shellcode via NtProtectVirtualMemory and EtwpCreateEtwThread to map and trigger the second-stage payload.
5. The second-stage implant queries the Solana blockchain account 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm to retrieve the address of the secondary C2 server.
6. The secondary C2 provides a COFF module that performs a UAC bypass and persistence setup.
7. The process copies itself to C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe and restarts to facilitate further module downloads.

Impact

The campaign has infected hundreds of victims, including both individuals and organizations, across diverse regions such as Russia, Türkiye, Japan, Kenya, Uganda, Colombia, and several European nations. Successful execution allows for remote command execution, potential data exfiltration, and long-term persistent access to the victim's environment.

Recommendation

• Monitor for execution of binaries masquerading as Microsoft telemetry components under C:\ProgramData\Microsoft\Windows\Telemetry.
• Block and investigate DNS queries for deadhub.org and network connections to 193.23.118.155.
• Implement detection for unusual mutex patterns generated by process loaders, such as random strings containing high-entropy characters.
• Deploy Sigma rules to detect unauthorized execution of binaries from non-standard ProgramData subdirectories.
• Train users to avoid downloading pirated media and to be skeptical of installation guides that request disabling antivirus software.