# The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through compromised torrents

itorrents.org torrent archive was compromised to serve malicious torrent files, infecting hundreds of victims with the MovieReaper multi-stage loader and file-manager implant.

- Payout: Real-world hack
- Severity: high
- Program: itorrents.org
- Analysis by: Konstantin Isakov, Pavel Cheremushkin
- Disclosed: 2026-09-17
- Write-up quality: 8/10
- Original: https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/
- Library page: https://bugbountylibrary.com/r/blog%3Asecurelist-com-moviereaper-malware-torrent-odyssey-solana-121344
- Tags: area:web domain:web impact:data-leak impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:high tech:solana tech:windows technique:chained technique:source-review vuln:misconfiguration vuln:rce

**Target:** Public torrent file repository (itorrents.org) and Windows endpoints
**Root cause:** Threat actor modified the widely used public torrent repository itorrents.org so that magnet-link downloads returned attacker-controlled torrent files pointing to a malicious loader, rather than compromising individual trackers.
**Steps:**
1. User clicks a magnet link on a torrent tracker that relies on itorrents.org for torrent files.
2. itorrents.org returns a different, malicious torrent file instead of the legitimate one.
3. The torrent downloads a loader EXE disguised as movie content, e.g. `the odyssey (2026) [1080p] [webrip] [5.1].exe` (MD5 A0B13781EDD7CFDAB13D79AFFF3C83C1).
4. User runs the EXE; loader creates mutex `Global\fnulSktzSqvVLXHU`, resolves APIs via PEB/Ldr parsing, and fetches shellcode parts over HTTP from `https://deadhub[.]org` (fallback `http://193.23.118[.]155`) using random paths like `/cloud/v192.4/ui/sync-status-icons.png`.
5. Loader maps shellcode RWX via NtProtectVirtualMemory and executes it through `EtwpCreateEtwThread`.
6. Stage 2 queries Solana `/getAccountInfo` for account `6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm`, XOR-decodes the second C2 address, and connects via TLS-pinned HTTPS with nanopb protobuf.
7. Stage 3 module performs UAC bypass, copies itself to `C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe`, and respawns with a special argument to skip anti-sandbox checks.
8. Final file-manager module exposes 21 commands for file download/upload/read, directory listing, file manipulation, and preview/thumbnail exfiltration.
**How found:** Threat hunting in mid-August 2026 identified a large-scale infection campaign; a common denominator was that all victims used torrent trackers, prompting investigation of the distribution mechanism and discovery that itorrents.org, not individual trackers, was the compromised source.
**Exploitation:** Attacker modified the itorrents.org repository so magnet-link downloads served malicious torrents; users manually executed the disguised loader, which pulled staged shellcode from a first-stage C2, resolved a second C2 via Solana blockchain storage, bypassed UAC, persisted as a masqueraded msedge.exe, and installed a modular file-manager implant giving the operator full filesystem access and exfiltration capability.
**Escalation:** Chained loader -> shellcode -> COFF module loading -> UAC bypass and persistence -> modular file-manager implant; blockchain-based C2 resolution hardened infrastructure against takedown.
**Insight:** Shared torrent-file repositories are a single point of compromise: one modified archive silently poisons every tracker that mirrors its torrents, so check whether a tracker's .torrent files are served from a third-party repository rather than generated locally.