Using a VPN out of Tbilisi, he downloaded the executable again , but this time from a different source—a Telegram channel called “Horion VIP (Russian official).” The channel had 27,000 subscribers. Its pinned message read:
“спасибо. я скачал это вчера. сегодня мой аккаунт Minecraft продан на Plati.market. ты спас мой банковский кошелек.”
Alex ran the file through a dynamic analyzer. The executable dropped a second-stage payload from a Pastebin URL. The payload was a PowerShell script that deobfuscated into a C2 beacon. The beacon’s domain: minecraft-updates[.]org . horion client скачать
He spun up a fresh Windows VM. No network drives. No shared clipboard. He downloaded the file—a 2.3MB executable named Horion_Installer_legit.exe . The icon was a familiar blue H. So far, so fake.
Alex felt cold.
And someone, right now, was looking for it. Alex opened his analytics dashboard. Over the past 72 hours, the search referral term had spiked 400%. Most of the traffic came from a cluster of IPs in Kazakhstan, Belarus, and the Russian exclave of Kaliningrad. Not script kiddies. Not curious 12-year-olds. Organized.
“Anyone else seeing horion скачать campaigns?” Using a VPN out of Tbilisi, he downloaded
Horion wasn’t just another cheat client for Bedrock Edition. Horion was the lockpick. The skeleton key. It could fly through unbreakable blocks, steal inventories, and—if the rumors on certain forums were true—inject shellcode into a host machine as easily as placing a dirt block.