Kenya and Uganda face growing cybersecurity threat from malware hidden in movie torrents
Kaspersky has uncovered an ongoing malware campaign targeting individuals and organizations in Kenya, Uganda, and several other countries, in which attackers disguise malicious software as popular films, including The Odyssey, to infect victims’ devices.
The campaign, identified by Kaspersky’s Global Research and Analysis Team (GReAT), has affected several hundred victims across multiple countries, including Russia, Türkiye, Japan, Kenya, Uganda and Colombia, as well as Spain, the Netherlands, Belgium and Germany.
The identified victims include organisations in the enterprise, government, information technology, consulting, retail, transportation and agriculture sectors. Kaspersky said the campaign has been active since at least mid-August and remains ongoing.
The attackers reportedly compromised a popular public torrent archive, using it to distribute the malicious payload to users who believed they were downloading films.
The malware operates through a multi-stage framework designed to evade detection, maintain access to infected devices, and give attackers remote control.
At the initial stage, the malware uses a loader capable of detecting antivirus sandboxes, isolated environments used by security products to analyze suspicious files. This capability allows the malware to identify when it is being examined and potentially evade detection or interfere with further investigation.
Once installed, the malware deploys additional modules that enable it to establish persistence, bypass Windows User Account Control (UAC), and gain administrator privileges without triggering the usual warning prompt. The malware ultimately provides attackers with remote access to compromised machines.
Kaspersky also found that the malware uses the Solana blockchain to retrieve the address of its command-and-control server, the infrastructure attackers use to communicate with infected devices. However, this approach can make the attackers’ infrastructure more resilient and complicate efforts to disrupt the campaign.
“The campaign is notable for combining a common lure with a sophisticated technical design. By disguising malware as torrents for popular films, the attackers increase the likelihood that unsuspecting users will download it. Once launched, the multi-stage malware is designed to evade detection, establish persistence, and provide the attackers with remote access to infected devices. Users should be especially cautious with files downloaded from unofficial sources, as even seemingly harmless entertainment content can serve as a vehicle for compromise,” said Konstantin Isakov, security expert at Kaspersky GReAT.
Furthermore, the discovery highlighted the cybersecurity risks facing users in Kenya and Uganda who download entertainment content through unofficial torrent platforms. While Kaspersky did not disclose the specific number of victims in either country, their inclusion in the identified countries indicates that the campaign has a geographical reach extending across East Africa.
Kaspersky advises users to download software, games and modifications from official sources or reputable websites and avoid disabling antivirus or other security tools to install files. The company added that its security solutions can detect the malware involved in the campaign.
Real ESG impact doesn’t happen in panels alone, it happens in the rooms where financiers, operators, and policymakers actually align. Our GreenShift Forum 2026 cuts the noise, bringing together the people rewiring Africa’s sustainability and energy frameworks for one focused day in Nairobi. Secure your seat.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke
