[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frpma7N0L41aL6m_uSx4sAx0PHxyyD5Ey_d1zLbS-suQ":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"9a8a7f85-8bd3-4ba5-a430-1b6bb8248639","Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes","fake-7-zip-installers-turn-devices-into-residential-proxy-nodes-1c061c","Cybersecurity researchers have disclosed details of a new threat actor dubbed Lurking Lizard that has been operating an end-to-end malicious residential proxy business using an infrastructure comprising more than 230 lookalike domains. The activity dates back to at least August 2022, according to DNS threat intelligence firm Infoblox. Once such campaign, observed earlier this year, involved the","A threat actor known as Lurking Lizard is operating a malicious residential proxy business, leveraging over 230 lookalike domains and a technique called drop-catching to acquire expired domains. They distribute malware disguised as legitimate software, such as 7-Zip installers and VPN applications, to recruit victim devices into a proxy botnet. This infrastructure is then monetized by impersonating legitimate proxy providers and running fake review sites to drive traffic to their own services.","Fake 7-Zip installers are used by Lurking Lizard to turn devices into proxy nodes.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Ffake-7-zip-installers-turn-devices-into.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEi0R7K2HuXIaXAr6VokIBdoRH5Zk8L2jJMM5abiDPtiOsT3DsQnI-FRSuTO02mekKGj2Cup9RBBYgAhyo92KHjyCTsMuctH8lYgwysOxpLpHp9uIuL7xBEuojc83nmWH7pcA1KRlu8W9-7b1caaoQMaNX2qATV_7e-CwoPSFk08VwjbRx2M-fgfMcjN3KeW\u002Fs1600\u002F7-zip-malware.png","2026-07-09T04:01:49+00:00","2026-07-09T06:00:20.429655+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"Lurking Lizard","threat_actor",{"name":21,"type":22},"7-Zip","product",{"name":24,"type":22},"WireVPN",{"name":26,"type":27},"Infoblox","vendor",{"name":29,"type":27},"Google",{"name":31,"type":27},"WEILAI NETWORK TECHNOLOGY CO., LIMITED","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"domain","7zip[.]com","Domain used to distribute trojanized 7-Zip installer.",{"type":36,"value":61,"context":62},"wirevpn - Fast Unlimited Proxy","Android application name used for distribution.",[29,26,31],{"controls":65,"vendors":151},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":96,"name":97,"problem":98,"products":99},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"slug":125,"name":126,"problem":127,"products":128},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[129,136,143],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":133,"url":134,"description":135},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":125,"product_name":140,"url":141,"description":142},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":167},"fake-software-installers-hijack-devices-for-proxy-botnet","Fake Software Installers Hijack Devices for Proxy Botnet","The Lurking Lizard threat actor exploits users' trust in recognizable software brands like 7-Zip by distributing malware through convincing lookalike domains, including expired domains acquired via drop-catching. Victims unknowingly install malicious installers that silently enroll their devices into a residential proxy botnet, which is then monetized by impersonating legitimate proxy services. This attack succeeds primarily because users fail to verify the authenticity of software sources before downloading and executing installers. The scale of over 230 lookalike domains demonstrates how low-cost infrastructure can support a large-scale, persistent threat operation. Organizations and individuals who do not validate software integrity or restrict download sources remain highly exposed to this class of supply chain and social engineering attack.",[157,158,159,160,161,162,163,164,165,166],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality \u002F Application Allowlisting","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-218 SSDF PW.4: Reuse Existing, Vetted Software","MITRE ATT&CK T1583.001: Acquire Infrastructure – Domains","MITRE ATT&CK T1036: Masquerading","MITRE ATT&CK T1090.002: Proxy – External Proxy",{}]