MovieReaper: the torrent is not the movie, and the next hop is on Solana

Kaspersky's GReAT team published MovieReaper on September 17. The lure is a movie. The file is a program. One of the names they catalogued pretends to be a 1080p rip of The Odyssey and ends in .exe. The long title is there so the extension slides out of the Explorer window. The icon looks like a real app. That part is not new. The distribution trick is.

They did not hack every tracker

A public torrent-file archive that many trackers rely on (itorrents.org, in Kaspersky's write-up) was compromised. When someone asked for a magnet, the archive could hand back a substituted torrent that fetched the loader instead of the film. One break-in, many sites. Kaspersky said the archive was still compromised when the report went out. The campaign has been running since at least mid-August. Victims include individuals and organizations in enterprise, government, IT, consulting, retail, transport, and agriculture, across Europe, Asia, and Africa.

After the loader runs, later stages look up the next command server using the Solana blockchain. That is not a Solana bug and it does not mean the victim owns crypto. It means the operators stored an address in a public chain so taking down one IP does not kill the campaign. Blocking the first-stage host still helps. Updating a blockchain account is how they move the second hop.

Why this shows up at work

People torrent on the home PC that also has the VPN and the mailbox. Or they do it on a shop laptop because the film is "just a download." MovieReaper gives remote file access. That is enough to steal a token, a password store, or a customer export. Kaspersky counted several hundred victims so far. The number will move. The habit will not, unless someone says the quiet part in the Friday briefing: unofficial video files are software.

What we would tell staff, without the lecture

• A movie file that is an .exe is not a movie. Show extensions. If the name is a paragraph long, look at the end.
• Home machines that reach corporate mail or MFA are in scope. BYOD policies that ignore "what did you install this weekend" are fiction.
• If you already allow personal devices, look for new persistence and unexpected outbound HTTPS after mid-August on anyone who admits to unofficial downloads.
• Do not treat blockchain C2 as unblockable magic. First-stage domains and IPs are still the cheap cut.

Bottom line

Entertainment lures still work because they feel off-policy. Forensic Five helps Canadian organizations say what is actually on the estate and what to fix first. From St. Albert, Alberta. The Odyssey is a film. The .exe is not.