7zip.com Is Serving Malware

Malwarebytes details a clever campaign exploiting the popularity of 7-Zip, redirecting users from the legitimate 7-zip.org to a lookalike 7zip.com which serves a trojanized installer. This sophisticated malware, known as "upStage Proxy," doesn't steal data or hold systems for ransom but rather silently converts infected machines into residential proxy nodes, monetizing unsuspecting users' bandwidth and IP addresses.

• The malicious site 7zip.com distributed an installer that bundled a functional 7-Zip with a hidden payload, Authenticode-signed with a revoked certificate.
• The malware components (Uphero.exe, hero.exe, hero.dll) install silently into C:\Windows\SysWOW64\hero\, establish persistence as Windows services with SYSTEM privileges, and manipulate firewall rules.
• It profiles the host system, uses encrypted communications to command-and-control servers, and enrolls the machine into a network of residential proxies, allowing third parties to route traffic through the victim’s IP.
• A key distribution vector identified was YouTube tutorials incorrectly linking to the fake domain, exploiting user trust in content ecosystems.
• The "proxyware" model represents a distinct threat: rather than disruptive, it aims for long-term, stealthy resource exploitation, making it harder to detect with traditional security measures due to its non-obvious behavioral signatures.
• Malwarebytes advises considering any system compromised if downloaded from 7zip.com and recommends verifying software sources, checking code-signing identities, monitoring system changes, and blocking known C2 domains.

This incident underscores a concerning trend where threat actors leverage brand impersonation and subtle, persistent malware to build monetization infrastructure, demonstrating that trust and vigilance are increasingly critical defenses against evolving cyber threats.