Fake 7-Zip downloads are turning home PCs into proxy nodes
ID: afdb886e-a2c4-5140-856e-dad4b7c11502
STIX ID: report--afdb886e-a2c4-5140-856e-dad4b7c11502
Feed Name: Malwarebytes Blog
Threat Score
This report describes a long-running campaign that used a lookalike 7zip.com site to distribute a trojanized 7‑Zip installer which installs Uphero/hero proxyware, establishes SYSTEM-level Windows services, modifies firewall rules, and enrolls victims as residential proxy nodes for monetization; the analysis includes file and network IOCs, detection guidance, and attribution to community researchers.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.