Several hundred victims have already been identified among both individual users and organizations in a multitude of countries, including Russia, Türkiye, Japan, Kenya, Uganda, and Colombia, as well as in several European countries such as Spain, the Netherlands, Belgium, Germany and others.
Kaspersky’s Global Research and Analysis Team (GReAT) has uncovered a sophisticated new multi-stage campaign targeting both individual users and organizations. The campaign relies on a previously unknown malware strain distributed through torrent trackers disguised as popular films, including The Odyssey. One of the popular public archives of torrent files was compromised and was then used to deliver the malicious payload. Victims already identified include organizations operating in the enterprise, government, IT, consulting, retail, transportation, and agriculture sectors. The campaign has been active since at least mid-August and remains ongoing.
The attack itself is built as a multi-stage framework composed of several elements that work together at different stages of the intrusion. At the initial stage, the malware uses a loader capable of detecting antivirus sandboxes, which are isolated testing environments security products use to safely examine suspicious files. This allows the malware to determine whether it is being analyzed and, if so, evade detection or hinder further investigation. Once active on a victim’s device, the malware deploys additional modules that expand its capabilities. These modules allow it to establish persistence, so it remains on the system after a reboot even after it has been terminated, bypass User Account Control (UAC) to gain administrator privileges in Windows without triggering the usual warning prompt and ultimately provide the attackers with remote access to the compromised machine.
To retrieve the address of its command-and-control server, the malware uses the Solana blockchain. This gives the attackers a more resilient way to maintain control over their infrastructure and makes the campaign harder to disrupt through blocking or takedown efforts.
“The campaign is notable for combining a common lure with a sophisticated technical design. By disguising malware as torrents for popular films, the attackers increase the likelihood that unsuspecting users will download it. Once launched, the multi-stage malware is designed to evade detection, establish persistence, and provide the attackers with remote access to infected devices. Users should be especially cautious with files downloaded from unofficial sources, as even seemingly harmless entertainment content can serve as a vehicle for compromise,” — says Konstantin Isakov, security expert at Kaspersky GReAT.
To stay safe Kaspersky recommends that users:
● Be cautious with downloads. It’s safer to install games and mods only from official sources or reputable websites. Unofficial sources may contain malware.
● Use a strong security solution, such as Kaspersky Premium, on all computers and mobile devices. It will warn you about potential threats and prevent infection.
● Never disable antivirus or security tools to download any files or software.
Organizations are recommended to:
● Implement clear guidelines for the use of third-party software on work devices.
● Use all-encompassing solutions from the Kaspersky Next product line that provide real-time protection, threat visibility, and the investigation and response capabilities of EPP, EDR and XDR. Depending on your current needs and available resources, you can choose the most relevant solution within this product line and easily migrate to another one if your cybersecurity requirements change.
● Provide your InfoSec professionals with an in-depth visibility into cyberthreats targeting your organization. The latest Kaspersky Threat Intelligence will provide them with rich and meaningful context across the entire incident management cycle and helps them identify cyber risks in a timely manner.
● If your company lacks cybersecurity expertise, adopt managed security services from Kaspersky such as Compromise Assessment, Managed Detection and Response and/or Incident Response which cover the entire incident management cycle – from threat identification to continuous protection and remediation.
Kaspersky security solutions detect the described malware. The full technical analysis is available on Securelist.com
.
