Hackers Weaponize 7-Zip Downloads to Turn Home PCs Into Proxy Nodes

A long-running campaign is using a counterfeit 7-Zip website (7zip.com) to distribute a digitally signed installer that stealthily installs residential proxyware (Uphero.exe, hero.exe, hero.dll) into Windows systems, registers as a service, modifies firewall rules, and communicates with encrypted C2 infrastructure (multiple "hero/smshero" domains). The malware includes VM/anti-debug checks, multiple encryption layers, autonomous update channels, and has been linked to other fake apps; the report provides file paths, SHA-256 hashes, and network IOCs for detection and remediation.