[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffPZl_G_L38G6u2sb2YAYrkujYkGTWBqSdgT5aFqAdFc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"8ca0c63b-24f8-4705-8cc4-6df8dd9226e9","fake-software-installers-hijack-devices-for-proxy-botnet","9a8a7f85-8bd3-4ba5-a430-1b6bb8248639","Fake Software Installers Hijack Devices for Proxy Botnet","The Lurking Lizard threat actor exploits users' trust in recognizable software brands like 7-Zip by distributing malware through convincing lookalike domains, including expired domains acquired via drop-catching. Victims unknowingly install malicious installers that silently enroll their devices into a residential proxy botnet, which is then monetized by impersonating legitimate proxy services. This attack succeeds primarily because users fail to verify the authenticity of software sources before downloading and executing installers. The scale of over 230 lookalike domains demonstrates how low-cost infrastructure can support a large-scale, persistent threat operation. Organizations and individuals who do not validate software integrity or restrict download sources remain highly exposed to this class of supply chain and social engineering attack.","**Immediate actions:**\n- Always download software exclusively from official vendor websites or verified package managers, never from third-party sites.\n- Verify file integrity by checking cryptographic hashes (SHA-256\u002FMD5) published by the official vendor before executing any installer.\n- Deploy DNS filtering solutions (e.g., Cisco Umbrella, Quad9) to block access to known malicious or lookalike domains.\n\n**Long-term improvements:**\n- Enforce application allowlisting policies so only pre-approved, signed software can be installed on endpoints.\n- Establish a vetted software distribution process (internal repository or MDM) to eliminate reliance on external download sources.\n- Conduct regular Security Awareness Training covering social engineering tactics, domain spoofing, and safe software acquisition habits.\n\n**Detection measures:**\n- Monitor endpoints for unusual outbound proxy or SOCKS traffic patterns that may indicate botnet participation.\n- Implement EDR (Endpoint Detection & Response) solutions to detect post-installation malicious behaviors such as unexpected network relay activity.\n- Regularly audit installed software across all endpoints against an approved inventory baseline to identify unauthorized applications.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality \u002F Application Allowlisting","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-218 SSDF PW.4: Reuse Existing, Vetted Software","MITRE ATT&CK T1583.001: Acquire Infrastructure – Domains","MITRE ATT&CK T1036: Masquerading","MITRE ATT&CK T1090.002: Proxy – External Proxy",{},"published","2026-07-09T06:21:27.25874+00:00","2026-07-09T06:21:26.944+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Ffake-7-zip-installers-turn-devices-into.html","fake-7-zip-installers-turn-devices-into-residential-proxy-nodes-1c061c","Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":56,"name":57,"problem":58},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]