Malware Hidden in Torrented Movie Downloads Hits Users in Kenya and Uganda: Detection and Response Guide

Threat researchers have identified an active campaign in which cybercriminals are bundling previously unseen malware inside torrent downloads for popular, in-demand films. According to reporting from Dark Reading, confirmed victims have been identified across Africa — notably in Kenya and Uganda — a region where high broadband costs and limited access to licensed streaming platforms make pirated content an especially effective lure.

This is not a novel technique — malware-ridden torrents are decades old — but two factors make this campaign worth your attention as a defender. First, the payload is described as new malware, meaning signature-based antivirus coverage is likely thin or nonexistent in the early window of the campaign. Second, the targeting tells us the operators are deliberately harvesting victims in regions where enterprise security telemetry, patch discipline, and user awareness programs are often least mature. If your organization operates in East Africa, employs remote staff there, or has third-party partners in the region, assume exposure.

The risk extends well beyond the individual who downloaded the movie. A single trojanized torrent executed on a home machine used for corporate email, a shared family laptop with cached VPN credentials, or a poorly segmented office workstation becomes an initial access foothold. In 2026, initial access brokers routinely monetize exactly this kind of opportunistic infection by selling it onward to ransomware affiliates. Treat every confirmed execution as a potential precursor to a larger intrusion — not as a nuisance malware event.

Technical Analysis

Attack Chain

Based on the reporting, the campaign follows a classic trojanized-content delivery model:

1. Lure: Attackers seed torrents for popular, recently released films — titles users are actively searching for — on public torrent indexes and trackers. High seed counts and positive comments (often fabricated or bot-driven) build false trust.
2. Delivery: The downloaded archive or directory contains what appears to be a video file, but is actually an executable. Common masquerading techniques include double extensions (Movie.Title.2026.1080p.mp4.exe with file extensions hidden by Windows Explorer defaults), executable icons swapped to resemble media player or video file icons, and bundled "codec packs" or "players" that claim the victim must install them to watch the film.
3. Execution: The victim double-clicks the file. Some variants display a decoy — an error dialog, a fake media player window, or even an actual low-quality copy of the film — while the payload installs silently in the background.
4. Persistence and staging: The malware establishes persistence (registry Run keys, scheduled tasks, or startup folder entries) and reaches out to command-and-control infrastructure, frequently over HTTPS to blend with legitimate traffic. From there, operators can push secondary payloads — stealers, RATs, or loader frameworks that resell access.

Affected Platforms

The primary target is Windows endpoints — the dominant desktop OS for torrent client users. There is no CVE associated with this campaign because no software vulnerability is being exploited: the "vulnerability" is user trust combined with default Windows behavior (hidden file extensions, icon spoofing). This is social engineering plus commodity endpoint weakness, not a patchable bug.

Exploitation Status

• Active in the wild: Yes — confirmed infections in Kenya and Uganda, with victimology likely broader than current reporting captures.
• CISA KEV: Not applicable (no CVE).
• Attribution: No named actor has been publicly tied to the campaign as of this writing. The victimology and monetization model are consistent with financially motivated crimeware operators rather than state-sponsored activity.

Why This Campaign Is Dangerous to Enterprises

Do not dismiss this as a consumer problem. In our incident response casework, trojanized media downloads have repeatedly been the patient-zero vector in environments that later suffered ransomware deployment. The typical path: employee downloads a film on a work laptop or a home machine enrolled in BYOD, a stealer or RAT harvests browser-stored credentials and session tokens, and those credentials are sold or used for corporate VPN, M365, or SaaS access weeks later. The torrent is the spark; the credential resale market is the accelerant.

Detection & Response

Because the payload is new and signatures lag, your detections must be behavioral. The highest-fidelity signals are: executables masquerading as media files, execution of binaries from user download/torrent directories, and persistence established shortly after such execution.

Sigma Rules

---
title: Executable Masquerading as Media File (Double Extension)
id: 3f8c2a71-6b4d-4e9a-b1c7-9d2e5f0a8b3c
status: experimental
description: Detects process execution of files with double extensions imitating video/audio formats, a hallmark of trojanized torrent payloads such as those reported in the Kenya/Uganda film torrent campaign.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/cybercriminals-hiding-new-malware-torrents-popular-films
  - https://attack.mitre.org/techniques/T1036/007/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1036.007
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '.mp4.exe'
      - '.mkv.exe'
      - '.avi.exe'
      - '.mov.exe'
      - '.mp3.exe'
      - '.webm.exe'
      - '.mp4.scr'
      - '.mkv.scr'
  condition: selection
falsepositives:
  - Extremely rare; legitimate software does not ship with media-extension double-suffix executables
level: high
---
title: Process Execution from Torrent or Downloads Directory Followed by Persistence
id: 8e1d4b92-2c7f-4a3d-9e6b-1c5a7f3d0e9b
status: experimental
description: Detects executables launched from user Downloads or common torrent client directories that subsequently write to registry Run keys or create scheduled tasks, consistent with dropper behavior observed in trojanized media campaigns.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/cybercriminals-hiding-new-malware-torrents-popular-films
  - https://attack.mitre.org/techniques/T1547/001/
  - https://attack.mitre.org/techniques/T1053/005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.t1053.005
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\qBittorrent\'
      - '\uTorrent\'
      - '\BitTorrent\'
      - '\Torrents\'
      - '\Vuze\'
      - '\Deluge\'
  condition: all of selection_*
falsepositives:
  - Rare; legitimate installers run from Downloads may set Run keys, tune with known-good installer hashes
level: high
---
title: Torrent Client Spawning Script Interpreter or Unsigned Child Process
id: 5a9f3e14-7d2b-4c8a-b6e1-3f0d9c2a7e5b
status: experimental
description: Detects torrent clients (qBittorrent, uTorrent, BitTorrent, Deluge) spawning script interpreters or command shells, which may indicate execution of malicious bundled content or fake codec installers.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/cybercriminals-hiding-new-malware-torrents-popular-films
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\qbittorrent.exe'
      - '\utorrent.exe'
      - '\bittorrent.exe'
      - '\deluge.exe'
      - '\transmission-qt.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: all of selection_*
falsepositives:
  - Torrent client 'run program on completion' features configured by power users
level: medium

KQL — Microsoft Sentinel / Defender

This hunt query identifies endpoints where executables masquerading as media files were created or executed, and correlates with subsequent persistence or outbound network activity. It runs against Defender for Endpoint tables; if you ingest Sysmon via Sentinel, adapt it to Event/SecurityEvent accordingly.

// Hunt: Trojanized torrent payloads - double-extension executables and post-execution behavior
let MediaDoubleExt = dynamic([".mp4.exe", ".mkv.exe", ".avi.exe", ".mov.exe", ".mp3.exe", ".webm.exe", ".mp4.scr", ".mkv.scr"]);
let SuspectDirs = dynamic(["\\Downloads\\", "\\Torrents\\", "\\qBittorrent\\", "\\uTorrent\\", "\\BitTorrent\\", "\\AppData\\Local\\Temp\\"]);
let ExecEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName has_any (MediaDoubleExt)
       or (FolderPath has_any (SuspectDirs) and FileName endswith ".exe" and InitiatingProcessFileName in~ ("explorer.exe", "qbittorrent.exe", "utorrent.exe", "bittorrent.exe", "deluge.exe"))
    | project DeviceId, DeviceName, ExecTime=TimeGenerated, FileName, FolderPath, SHA256, AccountName, InitiatingProcessFileName;
ExecEvents
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | project DeviceId, NetTime=TimeGenerated, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
) on DeviceId
| where NetTime between (ExecTime .. ExecTime + 30min)
| join kind=leftouter (
    DeviceRegistryEvents
    | where TimeGenerated > ago(14d)
    | where RegistryKey has_any ("\\Run", "\\RunOnce")
    | project DeviceId, RegTime=TimeGenerated, RegistryKey, RegistryValueName, RegistryValueData
) on DeviceId
| where isnull(RegTime) or RegTime between (ExecTime .. ExecTime + 30min)
| project DeviceName, AccountName, ExecTime, FileName, FolderPath, SHA256, RemoteIP, RemoteUrl, RemotePort, RegistryKey, RegistryValueData
| order by ExecTime desc;

Run a complementary query against DeviceFileEvents scoped to the last 30 days if your torrent-blocking controls were only recently deployed — infections often predate policy enforcement.

Velociraptor VQL

Use this artifact during triage of a suspected endpoint to enumerate masquerading executables in user download paths and cross-reference with persistence keys. Deploy it as a hunt across your East Africa user population or any at-risk OU.

-- Hunt for double-extension executables in user download/torrent directories
-- and correlate with Run-key persistence
LET media_ext = ('.mp4.exe', '.mkv.exe', '.avi.exe', '.mov.exe', '.mp3.exe', '.webm.exe', '.mp4.scr', '.mkv.scr')

LET files = SELECT FullPath, Mtime, Size,
       hash(path=FullPath).SHA256 AS SHA256
FROM glob(globs='C:/Users/*/{Downloads,Torrents,Desktop}/**/*', accessor='ntfs')
WHERE any(items=media_ext, x=> FullPath =~ x + '$')

LET runkeys = SELECT FullPath AS KeyPath, Name AS ValueName,
       String AS ValueData
FROM glob(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run*/**',
          accessor='registry')
WHERE ValueData =~ '(?i)downloads|torrents|appdata\\local\\temp'

SELECT FullPath, Mtime, Size, SHA256,
       KeyPath, ValueName, ValueData
FROM files
LEFT JOIN runkeys ON 1=1

Remediation / Containment Script

Use the following PowerShell on suspected endpoints or deploy via your RMM/Intune for a fleet sweep. It inventories masquerading executables, captures hashes for threat intel, and exports Run-key persistence entries for review. It does not auto-delete — preserve evidence first.

# Torrent Malware Triage Script - Security Arsenal IR
# Run elevated. Preserves evidence; does not delete artifacts.

$outDir = "C:\IR-Triage-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
New-Item -ItemType Directory -Path $outDir -Force | Out-Null

# 1. Find double-extension executables masquerading as media files
$mediaExts = @('.mp4.exe','.mkv.exe','.avi.exe','.mov.exe','.mp3.exe','.webm.exe','.mp4.scr','.mkv.scr')
$suspectFiles = Get-ChildItem -Path "C:\Users" -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $n = $_.Name.ToLower(); ($mediaExts | Where-Object { $n.EndsWith($_) }) } |
    Select-Object FullName, Length, CreationTime, LastWriteTime,
        @{N='SHA256';E={(Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash}}
$suspectFiles | Export-Csv "$outDir\masquerading-executables.csv" -NoTypeInformation

# 2. Export Run/RunOnce persistence entries pointing at user-writable paths
$runKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
)
$persist = foreach ($k in $runKeys) {
    if (Test-Path $k) {
        (Get-ItemProperty $k).PSObject.Properties |
            Where-Object { $_.Name -notmatch '^PS' -and $_.Value -match 'Downloads|Torrents|Temp|AppData' } |
            Select-Object @{N='Key';E={$k}}, Name, Value
    }
}
$persist | Export-Csv "$outDir\persistence-entries.csv" -NoTypeInformation

# 3. Capture recent scheduled tasks created by non-system accounts
Get-ScheduledTask | Where-Object { $_.Principal.UserId -notmatch 'SYSTEM|NETWORK SERVICE|LOCAL SERVICE' } |
    Select-Object TaskName, TaskPath, @{N='Author';E={$_.Principal.UserId}}, State |
    Export-Csv "$outDir\scheduled-tasks.csv" -NoTypeInformation

# 4. List recently created executables in AppData (common dropper staging location)
Get-ChildItem -Path "$env:LOCALAPPDATA","$env:APPDATA" -Recurse -Include *.exe,*.dll -File -ErrorAction SilentlyContinue |
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-14) } |
    Select-Object FullName, CreationTime, @{N='SHA256';E={(Get-FileHash $_.FullName -ErrorAction SilentlyContinue).Hash}} |
    Export-Csv "$outDir\recent-appdata-binaries.csv" -NoTypeInformation

Write-Host "[+] Triage complete. Evidence collected in $outDir"
Write-Host "[+] Next: isolate host from network, capture memory if active infection suspected, reset credentials used on this machine."

Remediation

Because this campaign exploits user behavior rather than a software flaw, there is no vendor patch — remediation is layered hardening and credential hygiene.

Immediate actions (24–48 hours) for confirmed or suspected infections:

1. Isolate the endpoint from the network (EDR network isolation or physical disconnect). Do not power off — capture volatile evidence first if IR resources permit.
2. Reset every credential used or stored on the affected machine: domain credentials, browser-saved passwords, M365/session tokens (revoke via Entra ID RevokeSignInSessions), VPN accounts, and any SaaS logins. Assume stealers exfiltrated the browser credential store — this is the single highest-impact step.
3. Hunt laterally: take the hashes from the triage script and sweep your fleet via EDR/Sentinel for matching file hashes, Run-key values, and C2 destinations observed in DeviceNetworkEvents.
4. Reimage the host from known-good media. New malware with unknown capabilities means in-place cleaning carries unacceptable residual risk.

Structural hardening (this quarter):

1. Show file extensions and block executable content from user-writable paths. Enable "show file extensions" via GPO, and deploy AppLocker or WDAC rules blocking execution from %USERPROFILE%\Downloads, %TEMP%, and torrent client directories for standard users. This single control breaks the entire attack chain — the payload cannot run even when the user double-clicks it.
2. Block or restrict torrent clients on managed endpoints. Enforce via application control policy and block common torrent ports/trackers at the egress firewall. There is rarely a legitimate business case for BitTorrent protocol on corporate assets.
3. Enforce phishing-resistant MFA (FIDO2/passkeys) on M365, VPN, and remote access. If stealer-exfiltrated passwords are the monetization path, MFA that resists token replay caps the blast radius of a successful infection.
4. Conditional Access for the region. For staff in Kenya, Uganda, and similar targeted regions, apply geolocation-aware Conditional Access policies and impossible-travel detections to catch credential replay from foreign infrastructure.
5. User awareness targeted at the actual lure. Generic phishing training won't help here. Brief users specifically that pirated film downloads are actively being weaponized against users in their region right now, and that "install this codec/player" prompts are an infection, not a requirement.
6. EGS egress monitoring: alert on new outbound connections from workstations to rare or recently registered domains within 30 minutes of execution events in download directories — the KQL query above operationalizes this.

If you lack endpoint telemetry coverage for remote/regional staff, close that gap now. This campaign succeeded precisely because it targets populations where defenders aren't watching.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub