Popular torrent site hijacked

Hackers compromised iTorrents.org, a free torrent repository, to spread Windows malware to hundreds of victims across Russia, Japan, Spain, the Netherlands, and Colombia.

Malware hidden in fake movies

The malware circulated through disguised pirated films, including Christopher Nolan's The Odyssey, which had only been released in theaters at the time.

One compromise reaches many

By compromising iTorrents.org, attackers could distribute malware through multiple torrent trackers without hacking each platform individually, multiplying their reach.

“This approach is particularly powerful because the threat actors can reach users of multiple trackers without compromising each platform individually.”

Site still spreading malware

iTorrents.org remains compromised. When users download torrents via magnet links, the site returns malicious files instead, triggering downloads of the MovieReaper malware loader.

“iTorrent.org remains compromised.”

MovieReaper malware details

The malware contains 21 functions including the ability to download, upload, read files, and exfiltrate data. It communicates with hackers using the Solana blockchain.

Wide range of targets hit

The malware infected organizations across enterprise, government, IT, consulting, retail, transportation, and agriculture sectors, showing the attack's broad impact.

How to stay safe

Avoid downloading from iTorrents.org and similar compromised sites. Windows Defender flagged the malware as Trojan Win32 Sonbokli A, so keep your antivirus updated.