The dangers of 7-Zip and WinRAR

The report explains a growing trend of threat actors abusing legitimate archiving tools like 7-Zip and WinRAR for data exfiltration and ransomware-like encryption, leveraging their trusted status to evade detection. It highlights the difficulty defenders face in distinguishing malicious from legitimate use, notes related malware delivery risks (e.g., Amos Stealer), and recommends controls such as application allowlisting, ringfencing to restrict tool capabilities, and monitoring for high read/write activity to mitigate these threats.