MovieReaper — Torrent-Delivered Loader with Solana Blockchain C2 Resolution

MovieReaper is a previously unknown, modular, multi-stage Windows malware framework disclosed by Kaspersky's GReAT team on 17 September 2026. It is distributed by way of a supply-chain-style compromise of itorrents[.]org, a public torrent-file repository that many independent tracker sites rely on to serve .torrent files. Rather than compromising trackers one at a time, the attackers compromised the shared repository itself: when a victim follows a legitimate magnet link, the repository silently returns a malicious torrent file instead of the requested one. The lure observed most often is a fake release of the film "The Odyssey" (filename pattern: the odyssey (2026) [1080p] [webrip] [5.1].exe), though the same loader hash has shipped under many different movie-themed filenames.

The infection chain runs four stages: (1) a loader with anti-sandbox evasion that downloads shellcode over plain HTTP from deadhub[.]org (IP fallback 193.23.118[.]155) at URI paths disguised as image assets; (2) shellcode that queries the Solana blockchain's getAccountInfo RPC endpoint for a specific account to retrieve a base64-encoded, XOR-encrypted second-stage C2 address — using a public blockchain as takedown-resistant dead-drop storage; (3) a module that performs a UAC bypass and persists by masquerading as %ProgramData%\Microsoft\Windows\Telemetry\msedge.exe; and (4) a final "file manager" implant exposing 21 commands for filesystem read/write/enumerate plus thumbnail/preview generation so operators can triage valuable files before exfiltration. Kaspersky reports several hundred victims — individuals and organizations — across Europe, Asia, and Africa, spanning enterprise, government, IT, consulting, retail, transportation, and agriculture sectors, with activity from the same actor traced back to October 2025.

Novel durable signal: the Solana blockchain dead-drop resolution step is the most distinctive and hardest-to-evade behavioral signature in this pack — legitimate business processes essentially never call public Solana RPC endpoints (getAccountInfo and similar) from a non-browser, non-wallet, non-dev-tooling process. That behavioral pattern survives IP/domain rotation and is the centerpiece hunt in §8 (Q9).

Both sources below were fetched directly during this pipeline run (raw HTML retrieved, tags stripped, article text extracted verbatim) and saved to MovieReaper-Torrent-Solana-Hunt-sources/ for provenance tracing. Neither snapshot contained any text directed at the researching agent (no embedded instructions, no claimed authorization, no request to fetch a different "real" IOC source) — both were reviewed specifically for prompt-injection content and found clean.

Checks that rely on tooling or telemetry outside native Falcon CQL — either because the signal isn't a first-class Falcon data-model field, or because it needs a different log source entirely.

Queries promoted to Custom IOA candidates are high-confidence, low-FP, and stable enough for always-on detection. All are recommended in Detect mode first, per the standard 14-day FP-measurement rollout before any promotion to Prevent.

Q2, Q5, Q6, Q8, Q9, and Q10 remain investigate-only hunt queries pending environment-specific tuning (medium/high FP as noted in their comment blocks). Q9 in particular deserves early operational attention despite its FP-medium rating: it is the only query in this pack built on a signal the actor cannot rotate away from without abandoning the blockchain-C2 technique entirely.

Packaged alert content for the two highest-value scheduled searches in this pack: the exact-path Stage 3 masquerade (Q4) and the novel Solana-RPC behavioral signal (Q9).

Scheduled Search 1 — Exact-Path Masquerade (Q4)

NAME:
HUNT: MovieReaper Masquerade - Telemetry Folder msedge.exe Execution

DESCRIPTION:
Detects execution of a binary at the exact path %ProgramData%\Microsoft\Windows\
Telemetry\msedge.exe, the confirmed Stage 3 persistence masquerade used by the
MovieReaper torrent-delivered loader framework. This is not a legitimate Edge
install or update-helper location under any documented Microsoft deployment
pattern. Used to catch the respawned, UAC-bypassed persistence stage after
initial infection from a poisoned torrent download.

MITRE: T1036.005 (Masquerading: Match Legitimate Name or Location), T1548.002 (Bypass User Account Control)
Tactics: Defense Evasion, Privilege Escalation
Priority: HIGH (escalate immediately - no legitimate explanation for this exact path)
FP Sources: none expected; if triggered, treat as a true positive pending investigation

═══════════════════════════════════════════════════════════
ALERT PACKAGE
═══════════════════════════════════════════════════════════

SUBJECT:
🚨 HUNT ALERT 🚨 — MovieReaper Masquerade Detected (Possible Persistence)

BODY:
A process named msedge.exe was observed executing from
%ProgramData%\Microsoft\Windows\Telemetry — a path with no legitimate Microsoft
Edge installation or update purpose. This is the confirmed Stage 3 persistence
mechanism for the MovieReaper torrent-delivered loader framework: a UAC-bypassed
respawn of the original loader, masquerading under a trusted-sounding filename.
This alert fires on execution (ProcessRollup2/SyntheticProcessRollup2), not on a
blocked attempt, so if you see this the process very likely ran. Check the parent
process, the original loader's arrival vector (torrent client / browser download
history), and pivot immediately to network telemetry for Stage 1/Stage 2 C2
contact (deadhub[.]org, 193.23.118[.]155, 208.64.33[.]90, 208.94.246[.]53) and to
DNS telemetry for Solana RPC lookups from the same host.

INVESTIGATION CHECKLIST:
1. Confirm execution vs. write-only: check #event_simpleName — ProcessRollup2/
   SyntheticProcessRollup2 means it ran; a PeFileWritten-only hit with no matching
   process event means the drop occurred but may not have executed yet.
2. Inspect ParentBaseFileName — a UAC-bypass LOLBin (fodhelper.exe, eventvwr.exe,
   computerdefaults.exe, sdclt.exe) or the original long-filename loader as parent
   is a strong confirmation.
3. Check CommandLine for any special respawn argument — Securelist notes the
   respawned process carries a flag that lets it skip anti-sandbox checks.
4. Pivot to DnsRequest/NetworkConnectIP4 on the same aid for deadhub[.]org,
   193.23.118[.]155, 208.64.33[.]90, 208.94.246[.]53, and any Solana RPC hostname
   (api.mainnet.solana.com or similar) in the surrounding time window.
5. Check UserName and browser/torrent-client download history for a recent
   movie-themed .exe download (e.g., referencing "the odyssey" or another
   current release).
6. Isolate the host if: execution confirmed AND any C2 contact (network or
   Solana RPC) is also present in the same window.

PIVOT QUERIES:

--- Pivot 1: All process activity from the confirmed masquerade path, this host ---
>> YOU NEED:  ComputerName         (hostname from the alert)
              Alert timestamp      (from the alert — set LogScale window to +/-30 min)
>> FILL IN:   ComputerName="REPLACE_WITH_HOSTNAME"

#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/i
| ComputerName="REPLACE_WITH_HOSTNAME"
| ImageFileName=/^C:\\ProgramData\\Microsoft\\Windows\\Telemetry\\/i
| table([@timestamp, UserName, ImageFileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

--- Pivot 2: Environment-wide frequency (single host = targeted; many = wider incident) ---
(no variables to fill in — runs as-is)

#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/i
| ImageFileName=/^C:\\ProgramData\\Microsoft\\Windows\\Telemetry\\msedge\.exe$/i
| groupBy([ComputerName], function=count(as=TotalHits), limit=500)
| sort(TotalHits, order=desc)

Scheduled Search 2 — Non-Browser Solana RPC Query (Q9)

NAME:
HUNT: MovieReaper C2 Resolution - Non-Browser Solana RPC Query

DESCRIPTION:
Detects a non-browser, non-wallet process resolving a public Solana blockchain
RPC hostname (api.mainnet.solana.com and equivalents). MovieReaper's Stage 2
shellcode uses the Solana getAccountInfo RPC call as a takedown-resistant dead
drop for its encrypted second-stage C2 address. Legitimate business processes
essentially never make this call outside approved developer/blockchain tooling,
which makes this one of the most durable behavioral signals in the pack — it
survives full C2 domain/IP rotation.

MITRE: T1102.001 (Web Service: Dead Drop Resolver)
Tactics: Command and Control
Priority: MEDIUM (escalate to HIGH if the host has no prior blockchain-dev baseline)
FP Sources: Solana CLI / Anchor developer tooling, crypto trading or monitoring bots, approved blockchain-integration services

═══════════════════════════════════════════════════════════
ALERT PACKAGE
═══════════════════════════════════════════════════════════

SUBJECT:
⚠️ HUNT ALERT ⚠️ — Non-Browser Solana RPC Query Detected (Possible Blockchain C2 Resolution)

BODY:
A process that is not a recognized browser or Solana developer tool resolved a
public Solana RPC hostname. This is the signature behavior of MovieReaper's
Stage 2 shellcode retrieving its encrypted second-stage C2 address from the
Solana blockchain. This alert fires on the DNS lookup, which may precede actual
C2 contact by only seconds — treat it with urgency comparable to a live C2 beacon
until proven otherwise. The two most important things to check are (1) whether
this host has any legitimate reason to touch Solana infrastructure, and (2)
whether the same process shows any of the other MovieReaper indicators (Q1, Q4,
Q7, Q8) in the same window.

INVESTIGATION CHECKLIST:
1. Check FileName/ImageFileName of the resolving process — a browser or a known
   Solana CLI/Anchor binary lowers priority sharply; anything else is a red flag.
2. Check whether this host or user has ANY documented blockchain-development or
   trading responsibility — if not, this is very likely malicious.
3. Pivot to NetworkConnectIP4 for the same process immediately after the DNS
   lookup — an actual TLS connection following the RPC query is the C2 handoff.
4. Cross-check the same aid for Q1 (hash), Q4 (masquerade path), and Q7/Q8
   (Stage 1/2 C2) in the preceding hours — MovieReaper's chain means these often
   cluster together.
5. Isolate if: no legitimate blockchain-dev justification AND any correlated
   MovieReaper indicator is also present.

PIVOT QUERIES:

--- Pivot 1: Full DNS + correlated process detail for this host ---
>> YOU NEED:  ComputerName         (hostname from the alert)
              Alert timestamp      (from the alert — set LogScale window to +/-30 min)
>> FILL IN:   ComputerName="REPLACE_WITH_HOSTNAME"

#event_simpleName=/^DnsRequest$/i
| ComputerName="REPLACE_WITH_HOSTNAME"
| DomainName=/^(api\.mainnet\.solana\.com|api\.mainnet-beta\.solana\.com|.+\.helius-rpc\.com|.+\.quiknode\.pro|rpc\.ankr\.com|solana-mainnet\.g\.alchemy\.com)$/i
| table([@timestamp, UserName, DomainName, ContextProcessId_decimal])
| sort(@timestamp, order=desc)

--- Pivot 2: Environment-wide frequency, grouped by resolving process ---
(no variables to fill in — runs as-is)

#event_simpleName=/^DnsRequest$/i
| DomainName=/^(api\.mainnet\.solana\.com|api\.mainnet-beta\.solana\.com|.+\.helius-rpc\.com|.+\.quiknode\.pro|rpc\.ankr\.com|solana-mainnet\.g\.alchemy\.com)$/i
| groupBy([ComputerName], function=count(as=TotalHits), limit=500)
| sort(TotalHits, order=desc)

A0B13781EDD7CFDAB13D79AFFF3C83C1  (Stage 1 loader - confirmed identical across many movie-themed filenames)
4843F9FAFCAE492F11E2D4D33DBB4CDD
5310CABAE3FBE6DB8742849B588093F9
70060341CAF3338697A7DDFE0FB62875
AD4643EEA15AC286FA47D1131F9EF756
D0B967571AC8A3863C7F324BF5BDE99C
D88D550D0FB8E60CFFFF3EA61FF7A067
# Excluded: 4334BBAEA8DE33BF9D45E9B4E4E3BC2 is only 31 hex chars in the source (malformed) - not shipped

deadhub[.]org  (Stage 1 C2 - shellcode delivery)
193.23.118[.]155  (Stage 1 C2 IP fallback)
208.64.33[.]90  (Stage 2 C2)
208.94.246[.]53  (Stage 2 C2)
/cloud/v192.4/ui/sync-status-icons.png  (one observed masquerade URI path on deadhub[.]org - malware randomizes path segments)

%ProgramData%\Microsoft\Windows\Telemetry\msedge.exe  (Stage 3 persistence masquerade path - detect/block via Q3/Q4/Q6)
Global\E4AyDKzvEhe2hgAr  (mutex - no native Falcon CQL telemetry, see Sec.7)
Global\fnulSktzSqvVLXHU  (mutex - no native Falcon CQL telemetry, see Sec.7)

6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm  (Solana account holding the encrypted stage-2 C2 address)
CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL  (custom Solana program used to write the encrypted C2 data)
api.mainnet.solana.com  (public Solana RPC endpoint used for getAccountInfo resolution - not a blockable IOC, supports the behavioral hunt in Q9)

[ ] deadhub[.]org and the three confirmed C2 IPs blocked/sinkholed at DNS or firewall - verified
[ ] WDAC/AppLocker denies unsigned executable launch from %ProgramData% and torrent-client download folders - verified
[ ] UAC set to highest notification level; auto-elevation of fodhelper/eventvwr/computerdefaults/sdclt not silently permitted - verified
[ ] Falcon Custom IOA deployed (Detect mode) for the confirmed hash set and the exact msedge.exe masquerade path - verified
[ ] Torrent/P2P client installation blocked or allowlisted on managed endpoints - verified
[ ] Outbound egress policy reviewed for direct process-level HTTPS to public blockchain RPC endpoints from non-approved hosts - verified

Falcon IOC Management Import (CSV)

type,value,action,severity,expiration,description,tags
md5,A0B13781EDD7CFDAB13D79AFFF3C83C1,detect,critical,2027-09-21,MovieReaper Stage 1 loader,campaign:MovieReaper
md5,4843F9FAFCAE492F11E2D4D33DBB4CDD,detect,critical,2027-09-21,MovieReaper loader/implant,campaign:MovieReaper
md5,5310CABAE3FBE6DB8742849B588093F9,detect,critical,2027-09-21,MovieReaper loader/implant,campaign:MovieReaper
md5,70060341CAF3338697A7DDFE0FB62875,detect,critical,2027-09-21,MovieReaper loader/implant,campaign:MovieReaper
md5,AD4643EEA15AC286FA47D1131F9EF756,detect,critical,2027-09-21,MovieReaper loader/implant,campaign:MovieReaper
md5,D0B967571AC8A3863C7F324BF5BDE99C,detect,critical,2027-09-21,MovieReaper loader/implant,campaign:MovieReaper
md5,D88D550D0FB8E60CFFFF3EA61FF7A067,detect,critical,2027-09-21,MovieReaper loader/implant,campaign:MovieReaper
domain,deadhub.org,detect,high,2026-12-20,MovieReaper Stage 1 C2 - shellcode delivery,campaign:MovieReaper
ipv4,193.23.118.155,detect,high,2026-10-21,MovieReaper Stage 1 C2 IP fallback,campaign:MovieReaper
ipv4,208.64.33.90,detect,high,2026-10-21,MovieReaper Stage 2 C2,campaign:MovieReaper
ipv4,208.94.246.53,detect,high,2026-10-21,MovieReaper Stage 2 C2,campaign:MovieReaper

JSON (machine-readable)

{
  "threat": "MovieReaper",
  "pack_version": "2026-09-21",
  "generated": "2026-09-21",
  "hashes": [
    { "algo": "md5", "value": "A0B13781EDD7CFDAB13D79AFFF3C83C1", "role": "stage1_loader", "confidence": "high", "sources": ["01"] },
    { "algo": "md5", "value": "4843F9FAFCAE492F11E2D4D33DBB4CDD", "confidence": "high", "sources": ["01"] },
    { "algo": "md5", "value": "5310CABAE3FBE6DB8742849B588093F9", "confidence": "high", "sources": ["01"] },
    { "algo": "md5", "value": "70060341CAF3338697A7DDFE0FB62875", "confidence": "high", "sources": ["01"] },
    { "algo": "md5", "value": "AD4643EEA15AC286FA47D1131F9EF756", "confidence": "high", "sources": ["01"] },
    { "algo": "md5", "value": "D0B967571AC8A3863C7F324BF5BDE99C", "confidence": "high", "sources": ["01"] },
    { "algo": "md5", "value": "D88D550D0FB8E60CFFFF3EA61FF7A067", "confidence": "high", "sources": ["01"] }
  ],
  "c2_infrastructure": [
    { "type": "domain", "value": "deadhub.org", "role": "stage1_c2", "sources": ["01", "02"] },
    { "type": "ipv4", "value": "193.23.118.155", "role": "stage1_c2_fallback", "sources": ["01", "02"] },
    { "type": "ipv4", "value": "208.64.33.90", "role": "stage2_c2", "sources": ["01"] },
    { "type": "ipv4", "value": "208.94.246.53", "role": "stage2_c2", "sources": ["01"] }
  ],
  "host_indicators": [
    { "type": "file_path", "value": "%ProgramData%\\Microsoft\\Windows\\Telemetry\\msedge.exe", "role": "stage3_persistence_masquerade", "sources": ["01", "02"] },
    { "type": "mutex", "value": "Global\\E4AyDKzvEhe2hgAr", "sources": ["01"] },
    { "type": "mutex", "value": "Global\\fnulSktzSqvVLXHU", "sources": ["01"] }
  ],
  "blockchain_indicators": [
    { "type": "solana_account", "value": "6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm", "role": "encrypted_c2_dead_drop", "sources": ["01"] },
    { "type": "solana_program", "value": "CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL", "role": "custom_write_program", "sources": ["01"] }
  ],
  "excluded": [
    { "type": "md5", "value": "4334BBAEA8DE33BF9D45E9B4E4E3BC2", "reason": "malformed in source - 31 hex characters, not shipped" }
  ]
}

Controls are scoped to the platforms MovieReaper actually touches: Windows endpoints (execution, persistence, UAC), network egress (C2 domain/IP and blockchain RPC), and user/policy controls around torrent usage. Each control cites a MITRE mitigation plus a platform benchmark or vendor guidance.

Playbook A — Block Confirmed MovieReaper Network Indicators

Prerequisites: Admin access to internal DNS resolver / DNS filtering service and
  perimeter firewall change rights.
Reboot required: No.

# Step 1 - Add the confirmed domain to your DNS sinkhole/filtering policy
# (example shown for a generic RPZ-style DNS firewall zone file entry)
deadhub.org CNAME sinkhole.internal.

# Step 2 - Add the confirmed IPs to your perimeter firewall deny list
# (example shown as generic iptables syntax - adapt to your platform)
iptables -A OUTPUT -d 193.23.118.155 -j DROP
iptables -A OUTPUT -d 208.64.33.90 -j DROP
iptables -A OUTPUT -d 208.94.246.53 -j DROP

# Step 3 - Verify
nslookup deadhub.org        # expect sinkhole/NXDOMAIN response
# attempt an outbound connection test to each blocked IP - expect timeout/refusal

Rollback: Remove the RPZ/sinkhole entry and the three iptables DROP rules; no
  other state change to undo.

Playbook B — WDAC Deny Rule for ProgramData\Microsoft\Windows\Telemetry Execution

Prerequisites: Windows 10 1903+/Windows 11, WDAC policy authoring rights, a pilot
  ring identified for compatibility testing.
Reboot required: Yes - policy refresh/enforcement typically requires a restart
  or a policy-refresh cycle depending on deployment method.

# Step 1 - Confirm current WDAC policy mode (audit vs enforced)
Get-CIPolicy -All | Select-Object PolicyID, PolicyOptions

# Step 2 - Add an explicit deny rule for any executable in the Telemetry subfolder
New-CIPolicyRule -FilePathRule "C:\ProgramData\Microsoft\Windows\Telemetry\*" -Deny

# Step 3 - Merge into your baseline policy, sign, and deploy to the pilot ring first
Merge-CIPolicy -PolicyPaths @("Base.xml","TelemetryDeny.xml") -OutputFilePath "Merged.xml"

# Step 4 - Verify
# Attempt to run a benign renamed .exe from the Telemetry folder on a pilot host -
# expect a WDAC block event (CodeIntegrity Event ID 3077 in Enforced mode, 3076 in Audit)

Rollback: Remove the TelemetryDeny rule from the merged policy, re-sign, and
  redeploy the prior policy version (keep the pre-change signed policy backed up
  before deployment).

Playbook C — Harden UAC Against Silent Bypass

Prerequisites: GPO or Intune deployment rights; pilot ring for testing impact on
  any legacy software that relies on silent elevation.
Reboot required: No (policy refresh/gpupdate is sufficient).

# Step 1 - Set UAC to "Always notify" and require the secure desktop
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 1 /f

# Step 2 - Ensure the built-in Administrator account also requires UAC prompts
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v FilterAdministratorToken /t REG_DWORD /d 1 /f

# Step 3 - Verify
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin
# expect value 2

# Step 4 - Spot-check with Q10 in this pack post-deployment - expect no successful
# silent elevation via fodhelper.exe/eventvwr.exe/computerdefaults.exe/sdclt.exe

Rollback: reg add the same keys back to their prior values (commonly
  ConsentPromptBehaviorAdmin=5, PromptOnSecureDesktop=1, FilterAdministratorToken=1
  is the Windows default - confirm your pre-change baseline before rolling back).

Playbook D — Falcon Custom IOA for Confirmed Hashes and Masquerade Path (Detect Mode)

Prerequisites: Falcon Custom IOA rule authoring rights.
Reboot required: No.

# Falcon Console -> Endpoint Security -> Custom IOA Rules -> New Rule Group
# "MovieReaper Defense" (Detect severity: High)

# Rule 1 - Confirmed hash execution
#   Rule Type: Process Creation
#   Field: MD5 Hash   Operator: matches any of the 7 confirmed hashes (see Sec.11)
#   Action: Detect (do not enable Block until 14-day FP review is clean)

# Rule 2 - Exact masquerade path
#   Rule Type: Process Creation
#   Field: Image Filename   Operator: matches (regex)
#   Pattern: .*\\ProgramData\\Microsoft\\Windows\\Telemetry\\msedge\.exe$
#   Action: Detect

Rollback: Disable or remove the rule group in the Falcon console; no endpoint
  state change to undo.

Phase 1 — Isolate

• Network-isolate (Falcon Network Containment) any host firing Q1 (confirmed hash), Q3/Q4 (Telemetry-folder drop/execution), or Q7/Q8 (confirmed C2 contact).
• Treat any Q9 (Solana RPC) hit on a host with no documented blockchain-development role as presumptively malicious pending investigation.
• Preserve current process/network/DNS Falcon telemetry for affected hosts before further remediation.

Phase 2 — Eradicate

• Remove the persistence binary at %ProgramData%\Microsoft\Windows\Telemetry\msedge.exe and confirm no autostart entry (Run key/scheduled task/service) still references it — the exact autostart mechanism is undocumented by either source, so check all three categories.
• Terminate any remaining loader/implant processes matching the confirmed hash set.
• Because the final-stage implant is a 21-command file manager with file read/copy/preview capability, treat any host that reached Stage 4 as a potential data-exposure incident, not just a malware infection — inventory what files were accessible to the compromised user account.
• Rotate credentials for any account active on an affected host during the suspected dwell window, prioritizing accounts with access to sensitive file shares (the file-manager implant's core capability is file access and exfiltration staging).

Phase 3 — Recover

• Validate backup integrity from a copy predating the earliest suspected compromise indicator on the host.
• Re-image affected endpoints where the persistence/UAC-bypass chain fully completed, rather than relying on in-place remediation of an undocumented autostart mechanism.
• Re-verify Playbooks B and C (WDAC Telemetry-folder deny, UAC hardening) are in effect on rebuilt hosts before returning them to production.
• Monitor for renewed activity from the same actor — Kaspersky traces this group's activity back to October 2025 with an evolving toolset, so recurrence with a modified loader/path is plausible.