Kaspersky Details MovieReaper Malware Framework Distributed via Compromised Torrent Trackers

Kaspersky researchers have uncovered MovieReaper, a previously unknown modular malware framework that spreads through popular torrent sites by masquerading as movies, games, and other content. The campaign began after attackers compromised the itorrents repository in October 2025, allowing malicious torrents to propagate across multiple trackers and infect hundreds of users across Europe, Asia, and Africa. MovieReaper uses a multi-stage infection chain that includes a fake executable with a VLC icon, shellcode delivery from an initial C2, and a secondary C2 address retrieved from the Solana blockchain to improve resilience against takedowns. Subsequent stages bypass Windows UAC for persistence before deploying a final module with 21 commands for file system access, exfiltration, and potential additional payload deployment. The same report also covers NightEagle attacks on Russian infrastructure and the PAYLOAD extortion campaign using Active Directory Group Policy. Separate research highlights new side-channel attacks such as InjectEave on headphones and DDRop against Intel TDX and AMD SEV-SNP protections, along with a zero-day in Google Pixel radio modules and the arrest of TeamPCP members facilitated by Google Threat Intelligence Group.

HabrSeptember 21, 2026Translated from Russian

Read at source

Kaspersky researchers have published a detailed analysis of MovieReaper, a previously unknown modular malware framework distributed through popular torrent trackers under the guise of films, games, and other media.

The campaign began after attackers compromised the itorrents repository in October 2025. Because many torrent sites rely on this repository, malicious files quickly spread to users worldwide, resulting in hundreds of infections across Europe, Asia, and Africa.

Instead of the expected media file, victims receive an executable such as the odyssey (2026) [1080p] [webrip] [5.1].exe. The file typically carries a long name and uses the icon of a legitimate application such as the VLC media player to appear trustworthy.

Upon execution, the malware contacts an initial command server to retrieve shellcode. It then queries the Solana blockchain for encoded data stored in a specific account; this data reveals the address of a second command-and-control server. The blockchain-based mechanism is designed to maintain operation even if parts of the infrastructure are blocked.

The second-stage payload bypasses Windows UAC to establish persistence. The final module provides 21 commands that allow remote operators to read, download, list, create, copy, rename, move, delete, and change permissions on files, create symbolic links, and generate image thumbnails for selective exfiltration before full file transfer. Additional modules can be deployed on demand.

Additional findings in the same report

The report also examines attacks by the NightEagle group against Russian corporate infrastructure and the PAYLOAD campaign, which uses Active Directory Group Policy objects to extort victim organizations.

Separate research covered in the publication describes the InjectEave attack that amplifies electromagnetic emissions from wired or wireless headphones to eavesdrop on audio up to 30 meters away, and the DDRop hardware attack that bypasses Intel TDX and AMD SEV-SNP memory protections in virtual machines. A zero-day privilege-escalation flaw in the radio module of Google Pixel smartphones has been patched, and two members of the TeamPCP cybercrime group were arrested in Australia after infiltration by the Google Threat Intelligence Group.

TeamPCP MovieReaper NightEagle PAYLOAD InjectEave DDRop Google Pixel

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Malware & Botnets

Malware & Botnets

Yoba Campaign Uses Signed ChatGPT and Claude Binaries for DLL Sideloading and XMRig Deployment

Researchers at Check Point Research have uncovered the Yoba malware campaign that distributes fake desktop clients for ChatGPT and Claude through GitHub repositories. The attackers bundle legitimate signed executables from OpenAI and Anthropic with a malicious DLL that gets loaded via classic sideloading. Once executed, the loader establishes persistence using the Windows Task Scheduler and retrieves additional payloads through Telegram, DNS over HTTPS, and the Catbox file hosting service. The campaign ultimately deploys the XMRig cryptominer, which pauses mining activity when user interaction is detected to avoid detection. No compromise of OpenAI or Anthropic infrastructure was found; the attackers simply repurpose the companies' signed binaries and reputation. The operation primarily targets home users and small-to-medium businesses with Windows systems.

AntiMalwareOct 28, 2026Translated from Russian

Malware & Botnets

uCreator Spyware Infiltrates Modified Telegram, WeChat and GCash Builds on Android

Security researcher Ovi has published a detailed analysis of uCreator, also known as YingGai, a commercial Android spyware platform designed for surveillance and remote app control. The malware intercepts messages, verification codes and account data directly inside legitimate applications without requiring root privileges. Infection vectors include tampered Telegram, WeChat and GCash APKs distributed through unofficial sources, as well as the Onion Box container that launches the target app inside a controlled environment. Once active, uCreator hooks into the host process, reads Telegram’s local message database through client interfaces, captures two-factor authentication passwords and hides its own session from the user. The operation is supported by cloud-based command panels and exposed GitLab repositories that revealed server-side code and development history. Compatibility problems have been noted on Android 17, and the total number of victims remains unknown.

AntiMalwareOct 26, 2026Translated from Russian

Malware & Botnets

Researchers Deploy Cowrie Honeypot Disguised as NVIDIA H100 Server to Study SSH Botnet Tactics

A cybersecurity team set up a realistic Cowrie honeypot on a fake server equipped with four NVIDIA H100 GPUs, 128 AMD EPYC cores, and terabytes of storage to observe what SSH brute-force bots actually do after gaining access. The trap used a custom StickyAuth module that allowed entry only after several failed attempts and locked in the successful credential pair per IP address. Over the first 12.5 hours the system recorded 1,846 connections from 126 unique IPs, 175 successful logins, and 1,524 commands executed, with the majority of activity traced to a single botnet linked to the Outlaw group. The attackers deployed SSH keys signed mdrfckr, changed the root password, killed competing processes, installed cron jobs, and downloaded a mining archive called dota3 containing an IRC backdoor and its own SSH scanner. The researchers also identified three realism issues in the base Cowrie setup—limited grep flags, outdated filesystem paths in Debian 12, and inconsistent hostname reporting—and patched them to keep sophisticated bots engaged longer. An auxiliary LLM service later summarized each session in Telegram for easier analysis.

HabrOct 25, 2026Translated from Russian