Security 1 publisher2 min readPublished September 17, 2026 at 9:10 AM PDT

MovieReaper reached several hundred victims through a compromised torrent file repository

Kaspersky says the trojanized torrents come from itorrents.org, the file archive many trackers pull from, and that the archive was still returning substituted files when the report went out. Organizations are among the several hundred victims.

The Watch · Security desk

Illustration accompanying MovieReaper reached several hundred victims through a compromised torrent file repository

What happened

Kaspersky says it identified a large-scale infection campaign in mid-August 2026. Previously unknown malware was disguised as popular movies and hit individuals and organizations in multiple countries.
The actors compromised itorrents.org, the widely used public repository of torrent files that trackers pull from, and those trackers passed on malicious torrents. The trackers themselves were not broken into.
Kaspersky counts several hundred victims across at least ten named countries, among them Russia, Turkiye, Japan, Kenya, Uganda, Colombia, Spain, the Netherlands, Belgium and Germany.
At the report's publication date the archive was still compromised, returning a substituted torrent file to magnet link requests that then pulls down the malware loader.

Compiled by The WatchSomething wrong?How this is made

Why it matters

exposure One repository compromise puts the combined user base of every tracker that depends on itorrents.org in reach. Kaspersky notes the actors got there without attacking any tracker individually.
constraint Indicator-based blocking only covers part of this. Kaspersky saw several loaders, so a hash block on the most common sample leaves the delivery path open while the archive keeps substituting files.
decision Organizations sit inside the victim count, and the shared trait was tracker use. Endpoint teams have to decide whether torrent client activity on managed machines is a detection trigger and not only an acceptable-use question.

The first stage arrives as an executable named to look like a film release, and Kaspersky reports an identical MD5, A0B13781EDD7CFDAB13D79AFFF3C83C1, across every download of that file ^[6]. The user still has to double-click. Kaspersky saw several loaders, each hiding behind a long filename and the icon of a well-known application, and says the filenames are long presumably to push the ".exe" out of view at the end ^[7].

On launch the loader sets a global mutex so that only one copy runs, then begins its checks ^[8]. Only the first step of the chain is written to disk before execution ^[9]. Strings are encrypted with a custom stream cipher and the code is otherwise not heavily obfuscated, with most of the countermeasures aimed at AV sandboxes ^[10]. The observed mutex strings are randomly generated per sample, such as Global\fnulSktzSqvVLXHU ^[8]. Across the loader set, then, the mutex is not a stable indicator ^[2].

Kaspersky found the framework while analyzing malware that uses blockchain networks for its C2 infrastructure ^[1]. The loader-stage detail in the report describes the mutex and the sandbox evasion ^[8]^[10]. A defender keying detection to on-chain C2 traffic is working ahead of what this report documents ^[3].

Kaspersky's earlier research found criminals returning to torrents as an initial infection vector with trojanized cracks and installers ^[12], and the report notes that installation guides for pirated software routinely instruct users to disable their antivirus ^[13]. This time the wrong file arriving was visible to the people it happened to: Kaspersky says it identified multiple user reports of suspicious downloads, including one on Reddit from a user of a popular movie torrent tracker ^[15]. The common factor across the victims it triaged was that all of them had used torrent trackers ^[11]. Kaspersky products detect the threat as HEUR:Trojan.Win64.Agent.gen ^[14].

What to watch

Whether itorrents.org is cleaned or pulled, and whether trackers stop resolving magnet links through it.
Later parts of Kaspersky's analysis naming MovieReaper's own C2 channel and its modules.
Any of the affected organizations disclosing what ran after the loader stage on their networks.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
During analysis of malware that leverages blockchain networks for its C2 infrastructure, Kaspersky discovered a previously unknown modular, multi-stage framework it dubbed MovieReaper.
ReportedSupportedView cited source
[2]
In mid-August 2026, Kaspersky threat hunting identified a large-scale infection campaign involving previously unknown malware disguised as popular movies, affecting both individuals and organizations across multiple countries.
ReportedSupportedView cited source
[3]
Kaspersky identified several hundred victims, including both individual users and organizations, in countries such as Russia, Turkiye, Japan, Kenya, Uganda and Colombia, as well as Spain, the Netherlands, Belgium and Germany.
ReportedSupportedView cited source
[4]
The threat actors did not compromise the torrent trackers themselves; they compromised itorrents.org, a widely used public repository of torrent files, so trackers that relied on that repository began distributing malicious torrent files to their users.
ReportedSupportedView cited source
[5]
As of the report's publication date the archive remained compromised: when a user attempts to download a torrent using a magnet link, the legitimate archive instead returns a different torrent file, which leads to the download of the malware loader.
ReportedSupportedView cited source
[6]
The most popular initial executable was distributed through torrent trackers under many different names, for example "the odyssey (2026) [1080p] [webrip] [5.1].exe", but the file hash (MD5: A0B13781EDD7CFDAB13D79AFFF3C83C1) was identical across all downloads.
ReportedSupportedView cited source
[7]
Kaspersky saw multiple different loaders, where the executable disguises itself with a long filename and the icon of some well-known application; most of the filenames are large, presumably to hide the ".exe" extension at the end.
ReportedSupportedView cited source
[8]
After the user manually starts the application, the loader establishes a global mutex to ensure only one loader runs at a time; the observed mutexes contain a randomly generated string, for example Global\fnulSktzSqvVLXHU.
ReportedSupportedView cited source
[9]
The infection chain consists of several steps, of which only the initial one is dropped on disk before execution, to avoid detection.
ReportedSupportedView cited source
[10]
The malware is not heavily obfuscated apart from strings encrypted with a custom stream cipher, and most of the countermeasures were aimed at avoiding detection by AV sandbox solutions.
ReportedSupportedView cited source
[11]
Kaspersky's initial analysis revealed a common factor among the victims: all had used torrent trackers.
ReportedSupportedView cited source
[12]
Kaspersky's previous research showed cybercriminals repeatedly turning to torrents as an initial infection vector, using trojanized cracks and installers to reach a large number of users.
ReportedSupportedView cited source
[13]
Installation guides for pirated software routinely instruct users to disable their antivirus, conditioning them to ignore potential threats.
ReportedSupportedView cited source
[14]
Kaspersky products detect this threat as HEUR:Trojan.Win64.Agent.gen.
ReportedSupportedView cited source
[15]
Kaspersky identified multiple user reports describing suspicious files being downloaded instead of the intended content, including a case reported on Reddit by a user of a popular movie torrent tracker.
ReportedSupportedView cited source
[16]
Kaspersky says the approach is particularly powerful because the threat actors can reach users of multiple trackers without compromising each platform individually.
ReportedSupportedView cited source
[d1]
The report names ten countries in its victim list.
DerivedSupported1 source— sign in to open
[d2]
Because the mutex string is randomly generated and varies between samples, the mutex is not a stable detection indicator across the observed loaders.
DerivedSupported1 source— sign in to open
[d3]
The blockchain C2 connection is stated as the research context in which MovieReaper was found, while the loader-stage technical detail published covers the mutex and sandbox evasion, so on-chain C2 indicators are not documented for this campaign in the report.
DerivedInsufficient1 source— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

securelist.com
1 article · September 17, 2026
The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The interesting part for anyone who writes software that resolves magnet links or mirrors torrent metadata is the shape of the break. Kaspersky says the archive answered a magnet request with a different torrent file than the one asked for, and the trackers that read from it passed the substitution on without noticing. A single host sits upstream of many sites that trusted it without checking. The report does not say how itorrents.org was breached, so the lesson available today is about trusting a shared metadata source.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence62

0100

Checkable artefacts, one source

Kaspersky publishes enough for others to test: one MD5 for the most common loader, a detection verdict, the C2 domain with its plain-HTTP fallback address, sample request paths, an example mutex. That is more than most crimeware write-ups offer. The victim figure is a different matter, resting entirely on the vendor's own telemetry, with no breakdown and no second count from a CERT or tracker operator. The copy of the report available to us also breaks off in the middle of the loader analysis, so the later stages of the chain are described only in outline.

Adoption52

0100

Several hundred victims on one vendor's count

Spread is real and ongoing: infections since mid-August across ten countries, organizations among them, and the archive still returning substituted torrents on publication day. What holds the number down is that a single vendor's install base defines it. Countries where Kaspersky has few sensors would not appear, and 'several hundred' is a floor with unknown slack above it.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

security
NightEagle is entering Russian corporate VPNs with valid stolen credentials
2 publishers
security
ICS blocking rate hits a 2022 low, and the global average is now the least useful number
1 publisher
security
Spoofed vendor download pages hand out a fresh payload hash on every click
2 publishers
security
SilkParasite: AI turns up as a build tool inside a human-run espionage kit, not as the author
2 publishers

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources