The 7-Zip Trap: How a 25-Year-Old Domain Was Weaponized to Turn Your PC into a Proxy Bot

The report details a campaign in which adversaries used the hijacked 7zip.com domain to distribute malicious installers that deploy UpHero.exe, hero.exe, and hero.dll into C:\Windows\SysWOW64\hero\, create a SYSTEM Windows service for persistence, modify firewall rules with netsh, perform system reconnaissance via WMI, and exfiltrate data to iplogger.org; infected hosts are repurposed as residential proxy nodes and security vendors have updated detections while ad-blocking lists were amended to block the domain.