Kaspersky Warns Malware Hidden in Movie Torrents as African Users Among Victims

NAIROBI — A sophisticated malware campaign is spreading through torrent trackers disguised as popular films, including The Odyssey, and security researchers say victims have been identified across multiple continents, including Kenya and Uganda.

Kaspersky's Global Research and Analysis Team (GReAT) said in a report released last week that the campaign has been active since at least mid-August and remains ongoing. Several hundred victims have been confirmed in Russia, Türkiye, Japan, Kenya, Uganda, and Colombia, as well as in several European countries including Spain, the Netherlands, Belgium and Germany. The victims span individual users and organisations in the enterprise, government, IT, consulting, retail, transportation, and agriculture sectors.

A Compromised Torrent Archive

The attackers gained access to a popular public archive of torrent files and used it to deliver the malicious payload. When users requested magnet links from trackers that relied on this repository, they received malicious torrent files instead of the content they sought. The compromised repository has been identified as iTorrents.org, a widely used public torrent file archive.

The malware, which researchers have named MovieReaper, is built as a multi-stage framework. The initial loader is capable of detecting antivirus sandboxes, the isolated environments security products use to safely examine suspicious files. If it determines it is being analysed, it evades detection or hinders further investigation. Once active on a victim's device, it deploys modules that establish persistence, bypass User Account Control to gain administrator privileges without triggering the usual warning prompt, and provide the attackers with remote access to the compromised machine.

Solana Blockchain Used for Command and Control

What makes this campaign particularly difficult to disrupt is how the attackers maintain control over their infrastructure. To retrieve the address of its command-and-control server, the malware queries the Solana blockchain, a decentralised public ledger that cannot be taken offline through conventional means.

This technique is part of a broader trend in cybercrime. The Dysphoria botnet, which has compromised roughly 200,000 devices worldwide, uses Ethereum and Solana blockchain domain names to hide its command infrastructure. Similarly, the Glassworm botnet used Solana blockchain transactions to encode command-and-control server addresses in memo fields, creating an immutable, publicly accessible dead drop that cannot be taken down through domain seizures or server blocking. The Solana blockchain acts as a resilient, takedown-resistant mechanism that gives attackers a way to maintain control even when their physical infrastructure is compromised.

Africa in the Crosshairs

The inclusion of Kenya and Uganda among the countries with confirmed victims reflects a broader pattern of cybercrime targeting African users. Kaspersky has previously identified Africa as a growing target for credential-stealing campaigns and other malware operations. The region's expanding internet penetration, coupled with relatively lower levels of cybersecurity awareness and protection, makes it an attractive market for attackers.

"Several hundred victims have already been identified among both individual users and organizations," Kaspersky said in its advisory, noting that the campaign remains active.

Broader Risks of Piracy

The campaign underscores a well-documented relationship between media piracy and malware distribution. Research presented to the World Intellectual Property Organization found that 33 percent of MP3 download sites in Latin America were linked to malware distribution, with 17 percent distributing malware directly and another 26 percent doing so indirectly through secondary pages. In Southeast Asia, consumers face an average 59 percent risk of malware infection from piracy sites, and nearly 80 percent of investigated pirate sites served malware-ridden advertisements. A 2025 report from the Alliance for Creativity and Entertainment found users up to 65 times more likely to encounter malware on piracy services than on legitimate sites.

A study published in the Journal of Quantitative Description tracked 244 torrent swarms involving more than 167,000 unique peer IP addresses across 220 jurisdictions. It found that pre-release windows, the period before a film's official launch, show elevated risk to users, with one-third of torrents carrying suspicious executables. The researchers noted that because BitTorrent operates as a federation of title-centric micro-networks with no stable chokepoint, broad interventions such as domain takedowns or network blocking do not map cleanly onto this distribution channel.

What Users and Organisations Should Do

Kaspersky's recommendations follow familiar lines. Users should be cautious with downloads and install software only from official or reputable sources. They should never disable antivirus or security tools to download files, and should maintain a strong security solution on all computers and mobile devices. Organisations should implement clear guidelines for the use of third-party software on work devices and provide information security professionals with in-depth visibility into cyberthreats targeting their networks.

Konstantin Isakov, a security expert at Kaspersky GReAT, said the campaign is notable for combining a common lure with a sophisticated technical design.

"By disguising malware as torrents for popular films, the attackers increase the likelihood that unsuspecting users will download it," Isakov said. "Once launched, the multi-stage malware is designed to evade detection, establish persistence, and provide the attackers with remote access to infected devices".

The campaign remains active, and Kaspersky says the number of victims is likely to grow as the malicious torrents continue to circulate through trackers that have not yet detected the compromise.