Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes
Summary
A new threat actor known as Lurking Lizard has been operating a residential proxy business using over 230 lookalike domains, compromising devices through fake 7-Zip installers. This campaign has been active since at least August 2022, with observed activity earlier this year.
IFF Assessment
This article details a malicious operation that compromises user devices to create a proxy network, which can be used for illicit activities and to mask the origin of further cyberattacks.
Defender Context
Defenders should be aware of campaigns that distribute malware via seemingly legitimate software installers, especially for popular utilities like 7-Zip. It highlights the ongoing threat of residential proxy networks being built using compromised devices, which can be leveraged by threat actors for various malicious purposes.