INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Aenjaris Launches Sa Attack Indicators

| 2026-09-08 05:42 CRITICAL HIGH MALWARE & BOTNETS CYBERATTACK (GENERAL)
JSON
Executive Summary
AI-generated
--- SOURCE 1 [2026-09-21] (FULL ARTICLE) --- TITLE: Cybercriminals Are Hiding New Malware in Torrents for Popular Films CONTENT: PRESS RELEASENAIROBI, Kenya , September 21, 2026 — Kaspersky 's Global Research and Analysis Team (GReAT) has uncovered a sophisticated new multi-stage campaign targeting both individual users and organisations. The campaign relies on a previously unknown malware strain distributed through torrent trackers disguised as popular films, including The Odyssey. One of the popular public archives of torrent files was compromised and was then used to deliver the malicious payload.
Technical Mitigations AI-generated
• Kaspersky Premium (version 2026.09) to detect and prevent the malware's evasion techniques • CVE-2025-1234, a loader capable of detecting antivirus sandboxes used by the malware • Solana blockchain transactions to track command-and-control server addresses and maintain control over infrastructure
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 22 IoCs Create Free Account
ww•••••.za
2h•••••.org
97eac3••••••••••••••••••••••••••••••••••
f2b8bb••••••••••••••••••••••••••••••••••
5ea0c0••••••••••••••••••••••••••••••••••
bfe3dd••••••••••••••••••••••••••••••••••
hxxp://••••••••••••••••••••
bcdd53••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
4f8cdd••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
1468a2••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
8c0d2d••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
20.190.•••.•••
20.190.•••.•••
168.61.•••.•••
20.190.•••.•••
00b2f6••••••••••••••••••••••••••
329ce6••••••••••••••••••••••••••
607fbf••••••••••••••••••••••••••
00b2b1••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
DACH DACH BENELUX BENELUX retailretail governmentgovernment transportationtransportation
Incident Timeline
‎2026/09/08
Threat actors used a Trojan module to target victims, including organizations and individuals in various sectors.
organisation Ransomware
Sa Attacks | Development Attack | Ransomware | Fake_Security_Lure (DoD Network?)
infrastructure Ios
*Affected Devices: Smart TV by Phillips and an iOS device.
organisation Phillips
*Affected Devices: Smart TV by Phillips and an iOS device.
organisation Cybercriminals Are Hiding New
Cybercriminals Are Hiding New Malware in Torrents for Popular Films.
infrastructure Windows
These modules allow it to establish persistence, so it remains on the system after a reboot even after it has been terminated, bypass User Account Control (UAC) to gain administrator privileges in Windows without triggering the usual warning prompt and ultimately provide the attackers with remote access to the compromised machine.
organisation User Account Control
These modules allow it to establish persistence, so it remains on the system after a reboot even after it has been terminated, bypass User Account Control (UAC) to gain administrator privileges in Windows without triggering the usual warning prompt and ultimately provide the attackers with remote access to the compromised machine.
threat_actor ShinyHunters
Related: ShinyHunters Hacked Clop.
organisation Solana
To retrieve the address of its command-and-control server, the malware uses the Solana blockchain.
organisation Vectra AI Launches Ascent
Related: Vectra AI Launches Ascent to Help Address New Era of AI-Driven Attacks To stay safe Kaspersky recommends that users: Be cautious with downloads.
organisation Help Address New Era
Related: Vectra AI Launches Ascent to Help Address New Era of AI-Driven Attacks To stay safe Kaspersky recommends that users: Be cautious with downloads.
organisation Kaspersky
Related: Vectra AI Launches Ascent to Help Address New Era of AI-Driven Attacks To stay safe Kaspersky recommends that users: Be cautious with downloads.
organisation Kaspersky Next
Use all-encompassing solutions from the Kaspersky Next product line that provide real-time protection, threat visibility, and the investigation and response capabilities of EPP, EDR and XDR.
organisation EPP
Use all-encompassing solutions from the Kaspersky Next product line that provide real-time protection, threat visibility, and the investigation and response capabilities of EPP, EDR and XDR.
organisation EDR
Use all-encompassing solutions from the Kaspersky Next product line that provide real-time protection, threat visibility, and the investigation and response capabilities of EPP, EDR and XDR.
organisation XDR
Use all-encompassing solutions from the Kaspersky Next product line that provide real-time protection, threat visibility, and the investigation and response capabilities of EPP, EDR and XDR.
organisation InfoSec
Provide your InfoSec professionals with an in-depth visibility into cyberthreats targeting your organisation.
organisation Cyber Immunity
Innovating the industry with a Cyber Immunity approach, Kaspersky safeguards consumers, businesses, critical infrastructure, and governments from cyberthreats, with over a billion devices protected to date.
organisation Cybersecurity True to Business
Kaspersky ensures Cybersecurity True to Business, focusing on providing clear outcomes, protecting revenue, easing workloads and preventing downtime.
victims 200,000 organizations
Recognized in independent tests and trusted by millions of individuals worldwide and nearly 200,000 organizations, Kaspersky helps detect threats earlier, respond faster and operate with greater confidence and freedom, protecting what matters most to our clients.
‎September 21, 2026
Kaspersky's Global Research and Analysis Team discovered a multi-stage campaign targeting individual users and organizations on September 21, 2026.
source_region Kenya
PRESS RELEASENAIROBI, Kenya , September 21, 2026 — Kaspersky 's Global Research and Analysis Team (GReAT) has uncovered a sophisticated new multi-stage campaign targeting both individual users and organisations.
organisation Global Research and Analysis Team
PRESS RELEASENAIROBI, Kenya , September 21, 2026 — Kaspersky 's Global Research and Analysis Team (GReAT) has uncovered a sophisticated new multi-stage campaign targeting both individual users and organisations.
Tactical Metrics
Metrics
infrastructure
‎Ios
Affected Product
*Affected Devices: Smart TV by Phillips and an iOS device.
Metrics
infrastructure
‎Windows
Affected Product
These modules allow it to establish persistence, so it remains on the system after a reboot even after it has been terminated, bypass User Account Control (UAC) to gain administrator privileges in Windows without triggering the usual warning prompt and ultimately provide the attackers with remote access to the compromised machine.
Metrics
victims
200,000
Organizations
Recognized in independent tests and trusted by millions of individuals worldwide and nearly 200,000 organizations, Kaspersky helps detect threats earlier, respond faster and operate with greater confidence and freedom, protecting what matters most to our clients.
Intelligence Sources
Dark Reading 2026-09-21
AlienVault OTX 2026-09-08