Threat Intel
MovieReaper Campaign Uses Compromised Torrents and Solana Blockchain for C2
A new multi-stage malware framework dubbed MovieReaper is distributing trojanized installers via compromised torrent storage repositories, impacting users and organizations globally. The campaign leverages the Solana blockchain to conceal its command and control infrastructure and employs evasion techniques to bypass sandbox detection.
What Happened
Researchers have uncovered a multi-stage crimeware framework named MovieReaper, distributed through popular torrent trackers. Rather than breaching the torrent sites directly, threat actors compromised a widely used public torrent file repository, itorrents[.]org. This allowed attackers to substitute legitimate media downloads—such as popular films like "The Odyssey"—with malicious executables.
Impact and Scope
The campaign has affected hundreds of individual and corporate targets across multiple regions, including Russia, Türkiye, Japan, Kenya, Uganda, Colombia, Spain, the Netherlands, Belgium, and Germany. The infection vector relies heavily on social engineering, frequently instructing victims to disable endpoint security solutions to execute the pirated content.
Technical Characteristics
MovieReaper utilizes a modular architecture designed to evade traditional security controls and sandbox environments. A notable characteristic of the framework is its reliance on the Solana blockchain to dynamically resolve and hide its command and control (C2) infrastructure, complicating network-level blocking efforts.
What Defenders Should Do
- Monitor network telemetry for anomalous outbound connections interacting with the Solana blockchain infrastructure from non-standard endpoints.
- Audit and restrict the execution of unsigned binaries, installers, and cracked software across corporate endpoints.
- Enforce centralized management of security solutions to prevent users from disabling antivirus or Endpoint Detection and Response (EDR) agents.
- Educate personnel on the risks associated with downloading unauthorized media and software from peer-to-peer networks.
Related articles
TONResolver RAT Targets Japanese Hospitality Sector via Booking.com Phishing
A targeted phishing campaign observed in May 2026 deployed the TONResolver RAT against hotels and accommodation providers in Japan. Threat actors utilized Booking.com-themed lures to deliver the malware, which uniquely abuses the TON blockchain for command-and-control operations.
Read briefing
DPRK Lazarus‑style Attack Targets macOS Blockchain Engineers via Discord‑Delivered Python Bot
North Korean actors leveraged a disguised Python arbitrage bot sent through a public Discord channel to compromise macOS systems of blockchain engineers. The multi‑stage malware, KANDYKORN, performs in‑memory binary loading and uses several evasion techniques. Defenders should block the ZIP, monitor for Watcher.py execution, and harden Discord access.
Read briefing
Operation Dream Job: From Job Offers to Zero‑Day Attacks on Defense Sectors
Check Point Research has traced a fresh wave of the Operation Dream Job campaign, a Lazarus‑linked effort that turns enticing job ads into a multi‑stage breach. The attackers now use a trojanized PDF viewer, the SecurityPDF app, to deliver a new kernel‑mode rootkit (FudModule) via the zero‑day CVE‑2026‑68820 in Microsoft’s AFD.sys driver. They also weaponize CVE‑2025‑49113 in Roundcube to plant RelayShell webshells, turning compromised servers into covert C2 relays. The campaign targets aerospace, aviation and defense firms worldwide, leveraging spear‑phishing, SEO‑boosted fake recruitment sit
Read briefing
AI-Driven Campaign Compromises Hundreds of E-Commerce Retailers Using Autonomous Harnesses
An active threat campaign leveraging three distinct AI harnesses is targeting online retailers to automate vulnerability research, exploitation, and orchestration. Security teams report that the attackers have successfully compromised dozens of companies, exfiltrating hundreds of thousands of payment cards and deploying web skimmers.
Read briefing