SmokeLoader malware aimed at multiple Ukrainian industries, using bug in file archiver

Researchers observed Russian-linked actors actively exploiting a 7‑Zip vulnerability (CVE-2025-0411) to bypass Windows Mark-of-the-Web protections and deliver SmokeLoader via phishing attachments to Ukrainian government, transportation, healthcare, utility, manufacturing organizations and at least one major bank; the campaign (attributed to groups tracked as UAC-0006 with overlaps to FIN7) appears aimed at espionage and credential/data theft.