CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

MovieReaper

malware · malware:moviereaper single-source

Modular multi-stage Windows crimeware framework active since at least October 2025, distributed via a supply-chain compromise of the shared public torrent-file repository itorrents.org; uses the Solana blockchain as a dead-drop resolver for second-stage C2 and an ETW-thread-creation technique for in-memory shellcode execution (Kaspersky Securelist, 2026-09-17).

Coverage
1
first 2026-09-18 → last 2026-09-29
Latest activity
2026-09-18
Kaspersky: a single compromised torrent-file repository silently poisoned magnet-link resolutions across many…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector
Sources cited
1
1 hosts

Defender insights

What each entry about MovieReaper tells a defender to do, newest first.

2026-09-18NOTABLEKaspersky: a single compromised torrent-file repository silently poisoned magnet-link resolutions across many unrelated tracker sites

Story timeline

  1. 2026-09-18MovieReaper: a modular crimeware framework distributed via a torrent-file-repository supply-chain compromise, using the Solana blockchain as a C2 dead-drop resolver
    active-threatsKaspersky: a single compromised torrent-file repository silently poisoned magnet-link resolutions across many unrelated tracker sites

Hunting pivots

Tags
botnetsupply-chain
ATT&CK techniques (8 across 5 tactics)

8 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessSupply Chain Compromise: Compromise Software Supply Chain
  • ExecutionNative API · User Execution: Malicious File
  • Privilege EscalationAbuse Elevation Control Mechanism: Bypass User Account Control
  • StealthMasquerading: Match Legitimate Resource Name or Location · Deobfuscate/Decode Files or Information · Reflective Code Loading
  • Command and ControlWeb Service: Dead Drop Resolver

Initial Access TA0001

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-09-18/moviereaper-torrent-supply-chain-solana-c2 · ATT&CK page ↗

Execution TA0002

T1106Native API×1

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.

Evidence: 2026-09-18/moviereaper-torrent-supply-chain-solana-c2 · ATT&CK page ↗

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-09-18/moviereaper-torrent-supply-chain-solana-c2 · ATT&CK page ↗

Privilege Escalation TA0004

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control×1

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.

Evidence: 2026-09-18/moviereaper-torrent-supply-chain-solana-c2 · ATT&CK page ↗

Stealth TA0005

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-09-18/moviereaper-torrent-supply-chain-solana-c2 · ATT&CK page ↗

T1140Deobfuscate/Decode Files or Information×1

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

Evidence: 2026-09-18/moviereaper-torrent-supply-chain-solana-c2 · ATT&CK page ↗

T1620Reflective Code Loading×1

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Evidence: 2026-09-18/moviereaper-torrent-supply-chain-solana-c2 · ATT&CK page ↗

Command and Control TA0011

T1102.001Web Service: Dead Drop Resolver×1

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

Evidence: 2026-09-18/moviereaper-torrent-supply-chain-solana-c2 · ATT&CK page ↗

Entries about MovieReaper (1)

2026-09-18 · view entry permalink →

NOTABLEupdatedNATOB2

MovieReaper: a modular crimeware framework distributed via a torrent-file-repository supply-chain compromise, using the Solana blockchain as a C2 dead-drop resolver

Kaspersky documents MovieReaper, a previously undocumented modular Windows crimeware framework active since at least October 2025, distributed through a supply-chain compromise of itorrents.org, a shared public repository many independent torrent trackers rely on to resolve magnet links. The actor modified that repository instead of compromising the trackers, which lets it reach users of many trackers without compromising each platform individually (Kaspersky Securelist, 2026-09-17). Kaspersky reports several hundred victims, individuals and organizations, with infection attempts in Russia, Spain, Germany, Finland, Türkiye, Japan, Nepal, Kenya, Tanzania, Ghana, Uganda, Colombia, the Netherlands, Belgium and other countries across Europe, Asia, Africa and Latin America, and targeted organizations spanning enterprise, government, IT, consulting, retail, transportation and agriculture (Kaspersky Securelist, 2026-09-17). After a user manually runs a first-stage loader disguised under a film-referencing filename, the loader resolves Windows API addresses by manually walking the PEB's loaded-module list rather than calling LoadLibrary or GetProcAddress, then registers a vectored exception handler that triggers a deliberate debug break to redirect control flow into a manually located raw syscall instruction inside ntdll and call NtProtectVirtualMemory directly, before invoking the undocumented ntdll export EtwpCreateEtwThread, which Kaspersky describes as a popular alternative to CreateThread, to execute the mapped shellcode (Kaspersky Securelist, 2026-09-17). The second stage queries the legitimate Solana blockchain's public getAccountInfo RPC endpoint to retrieve an XOR-encrypted C2 address, which Kaspersky notes gives the operators decentralized storage for C2 addresses that blocking C2 server IP addresses alone does not disrupt (Kaspersky Securelist, 2026-09-17). A third stage performs a UAC bypass and persistence and copies the original binary to msedge.exe in the Microsoft\Windows\Telemetry folder under ProgramData, so an Edge-named executable runs from outside Edge's install directory, then hands off to a final remote-file-manager module exposing 21 filesystem commands, including preview commands Kaspersky reads as built for pre-exfiltration triage of image and document contents (Kaspersky Securelist, 2026-09-17).

we discovered a previously unknown modular, multi-stage framework that we dubbed MovieReaper

instead of compromising torrent trackers, the threat actor modified a widely used public repository of torrent files

Utilizing the Solana blockchain as a storage layer for next-stage C2 endpoints substantially complicates infrastructure takedown efforts by defenders.

Kaspersky (Securelist) 2026-09-17
Correctionrun 2026-09-29T2134Z-auditsummarysourcing_noteevidencebody

Kaspersky has revised its report since first publication. It now describes the distribution as the actor modifying the public torrent-file repository instead of compromising the torrent trackers, and the list in its Victims section now adds Latin America to the affected regions and names Uganda, Colombia, the Netherlands and Belgium, countries the introduction named from the start (Kaspersky Securelist, 2026-09-17). The earlier text of this entry described the victims as spanning Europe, Asia and Africa only and contrasted the repository compromise with trojanized installers on individual sites.

The analysis had also described the third stage as masquerading as a Windows Telemetry executable. The report says it copies the original binary to msedge.exe in a Windows Telemetry folder under ProgramData, an Edge name in a Telemetry location, and the analysis now says so (Kaspersky Securelist, 2026-09-17).

threat18 Sep 04:58Zsingle-sourceOpen finding →
Sources: Kaspersky (Securelist)

explore in graph

Where this entity is cited

  • Threats1

Source distribution

  • securelist.com1 (100%)
All cited sources (1)