Anyone who pulled a copy of "The Odyssey" off a torrent tracker in recent weeks may have ended up with a file called the odyssey (2026) [1080p] [webrip] [5.1].exe. It is not a movie. It is the first stage of a modular espionage framework that Kaspersky has named MovieReaper, and researchers Konstantin Isakov and Pavel Cheremushkin count several hundred victims already, individuals and organizations alike, in Russia, Turkiye, Japan, Kenya, Colombia, Spain, Germany and the Netherlands among others.
The clever part is where the attackers got in.
One archive, every tracker at once
They never touched the torrent sites themselves. Instead they compromised itorrents[.]org, a public repository of torrent files that many trackers quietly depend on. Click a magnet link on one of those sites and the archive hands back a different torrent than the one you asked for, and that torrent fetches the loader. Poisoning a single supplier reached the users of many trackers without breaking into any of them, and Kaspersky says the archive was still compromised at the time it published. Affected organizations span enterprise, government, IT, consulting, retail, transport and agriculture.
Its address book lives on a blockchain
The loader spends its first moments checking whether anyone is watching. It hunts down the Windows functions it needs by walking structures in memory instead of asking for them the normal way, a trick aimed at antivirus sandboxes rather than at people. Satisfied, it pulls shellcode down in pieces over plain HTTP from deadhub[.]org, falling back to 193[.]23[.]118[.]155, disguised as harmless file names such as sync-status-icons.png.
That shellcode then asks the Solana blockchain for its real orders. It queries one specific Solana account, and the encrypted data parked there is the address of the second command server. Kaspersky notes that this gives the operators decentralized storage for their C2 addresses and makes the campaign harder to disrupt by blocking IP addresses, the same reasoning behind a remote access trojan that hid its C2 on the TON blockchain and went after Japanese hotels earlier this year.
Stage three bypasses Windows User Account Control, sets up persistence, and relaunches the malware from %ProgramData%\Microsoft\Windows\Telemetry\msedge.exe, so a glance at a process list shows something that looks like Edge. The last module Kaspersky recovered is a file manager exposing 21 commands: list directories, read, copy, rename, delete, upload and download. Two of them fetch thumbnails and previews, which lets an operator window shop a victim's documents and photos before spending bandwidth on the real files. Kaspersky expects more modules are loaded on demand.
The chain has one weak link, use it
Kaspersky points at the first stage as the place to break this. Everything downstream is flexible, but the loader reaches for exactly one domain and one fallback IP address to fetch its shellcode, so taking that server down stops the infection before Solana ever enters the picture. Kaspersky products detect the samples as HEUR:Trojan.Win64.Agent.gen. For everyone else the lesson is older than blockchain C2: a movie file does not end in .exe, and the absurdly long filenames here exist to push that extension off the end of the window. The same bait keeps working, as a fake GTA 6 installer that wiped disks showed only days ago.
Indicators, defanged: first stage C2 deadhub[.]org and 193[.]23[.]118[.]155; second stage C2 208[.]64[.]33[.]90 and 208[.]94[.]246[.]53; loader MD5 a0b13781edd7cfdab13d79afff3c83c1; persistence path %ProgramData%\Microsoft\Windows\Telemetry\msedge.exe. The full write up and hash list are in the original Kaspersky report.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.