> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes - URL: https://f4n6.co.uk/security-feed/fake-7-zip-installers-turn-devices-into-residential-proxy-nodes/ - Published: 2026-07-09T09:35:01.000Z - Updated: 2026-07-09T09:35:01.000Z - Author: Jeff Davies - Tags: #security-feed, Lurking Lizard ## 1\. Executive summary Infoblox has disclosed a threat actor dubbed "Lurking Lizard" operating an end-to-end malicious residential proxy business using trojanized installers — including a fake 7-Zip installer hosted on 7zip\[.\]com — to covertly recruit victim devices as proxy nodes. Attribution to a China-based actor is unconfirmed: "Lurking Lizard" has no MITRE ATT&CK profile, and the assessment rests on WHOIS analysis and infrastructure fingerprinting from a single vendor (Infoblox). The campaign dates to at least August 2022 and uses more than 230 lookalike domains, impersonating major proxy providers (IPIDEA, SmartProxy/Decodo, IP Royal, 911Proxy) and distributing lures for 7-Zip, WhatsApp, TikTok/YouTube downloaders, and WireVPN. For EMEA financial services, the primary risk is corporate endpoints being silently enrolled as proxy exit nodes, exposing the organisation's IP space to third-party criminal traffic and potential reputational and legal liability. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | Trojanized installers compromising corporate endpoints and enrolling them as proxy nodes constitute an ICT-related incident requiring detection, containment, and response. | Firms must have processes to identify, triage, and respond to endpoint compromise via malicious software installers. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | Endpoint compromise via trojanized 7-Zip installer is a cyber threat requiring classification per the firm's taxonomy. | Incident must be classified by impact severity; proxy-node enrolment may have minor direct impact but significant indirect risk. | | DORA Art. 24: digital operational resilience testing — general requirements | The campaign exploits user-downloaded software from lookalike domains, indicating a need for resilience testing of endpoint controls against social-engineering-driven malware. | Firms should validate that endpoint controls (EDR, proxy filtering, application allow-listing) detect and block trojanized installers. | | NIS2 Art. 21(2)(d): supply chain security measures | The threat actor uses expired-domain acquisition (drop-catching) and lookalike domains to distribute trojanized software, engaging supply-chain risk for software downloads. | In-scope organisations must assess software sourcing controls and block downloads from unverified/lookalike domains. | | UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties | A UK-registered company (WEILAI NETWORK TECHNOLOGY CO., LIMITED) is associated with the Android app "wirevpn - Fast Unlimited Proxy" with 1M+ downloads, potentially implicating UK corporate registration as an attack vector. | UK OES/RDSPs should be aware of the UK nexus and assess endpoint exposure. | ## 3\. Technical analysis & attack chain ### Confirmed attack chain 1. **Domain acquisition and infrastructure setup.** The actor uses "drop-catching" — acquiring expired domains to inherit their accumulated history and legitimacy. The actor has registered 230+ lookalike domains impersonating legitimate proxy providers and software projects. In some cases, the actor exploits incorrectly referenced domain names (e.g., victims typing "7zip\[.\]com" instead of the official "7-zip\[.\]org"). 2. **Victim acquisition.** Victims are directed to malicious installers through three channels: tutorial content, search-driven discovery, and lookalike domains. Fake "independent" review sites drive traffic to the actor's scam storefronts. 3. **Trojanized installer delivery.** The 7-Zip campaign delivered a trojanized 7-Zip installer from "7zip\[.\]com." Additional lures served from the same infrastructure include fake installers for WhatsApp, tools falsely claiming to be TikTok and YouTube downloaders, and WireVPN. 4. **IPLogger beacon.** Samples tied to the 7-Zip campaign contain an embedded IPLogger URL: `iplogger[.]com/mnWD`. This URL links the 7-Zip campaign to the broader infrastructure serving all the above-mentioned lures. 5. **Proxy node enrolment.** Compromised desktop devices are converted into proxy exit nodes that funnel third-party traffic through victims' devices. The actor then monetizes the proxy pool through lookalike proxy service brands. 6. **Monetization.** The proxy pool is sold through lookalike brands impersonating IPIDEA, SmartProxy (now Decodo), IP Royal, and 911Proxy. Proxyway found 773,087 unique IP addresses linked to SmartProxy also present in a publicly available IPIDEA IP dataset of 16,192,293 unique IPs, suggesting SmartProxy either resells IPIDEA's infrastructure or uses it as a significant IP source. 7. **Mobile expansion.** The WireVPN branding represents the latest evolution, targeting Android, macOS, and Windows. An Android app called "wirevpn - Fast Unlimited Proxy," developed by UK-based "WEILAI NETWORK TECHNOLOGY CO., LIMITED," has amassed 1M+ downloads. It is unclear whether these downloads are organic, and it is unclear whether the same proxy exit-node functionality is present in the mobile applications or limited to desktop. **Attribution caveat:** "Lurking Lizard" has no MITRE ATT&CK profile; attribution is unconfirmed. The China-based assessment rests on WHOIS analysis and infrastructure fingerprinting from Infoblox alone — single-sourced; verify before enforcement. **Technical gaps in source material:** The source does not provide specific malware family names, file hashes, C2 protocols, persistence mechanisms, registry keys, file paths beyond the installer domain, or command-line artefacts. The exact mechanism by which the trojanized installer enrols devices as proxy nodes is not described. No CVE is referenced. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Block known malicious domains** at DNS resolver and web proxy: `7zip[.]com`, `iplogger[.]com` (or specifically the path `iplogger[.]com/mnWD`). Note: `iplogger[.]com` is a legitimate IP-logging service abused as infrastructure; consider blocking the specific URL path rather than the entire domain if business use exists. - **Block the Android application** "wirevpn - Fast Unlimited Proxy" (developer: WEILAI NETWORK TECHNOLOGY CO., LIMITED) on all MDM-enrolled devices. - **Search endpoint telemetry** for historical connections to `7zip[.]com` and `iplogger[.]com/mnWD` (last 12 months minimum, given campaign dates to August 2022). - **Alert on outbound proxy traffic** from workstations that should not be running proxy services — unexpected listening ports, unusual outbound connection patterns consistent with proxy relay. ### P2 — Within 72 hours - **Application allow-listing / software download policy:** Block user-initiated downloads of executable installers from non-approved domains. Ensure the official 7-Zip domain is documented as `7-zip[.]org` in user guidance and IT documentation. - **Review DNS logs** for any of the 230+ lookalike domains. The source does not enumerate them all; request the full list from Infoblox if available, or hunt for domains impersonating: IPIDEA, SmartProxy, Decodo, IP Royal, 911Proxy, WireVPN. - **EDR hunt:** Search for processes named or matching `wirevpn`, and any 7-Zip installer binaries not signed by the legitimate 7-Zip publisher or downloaded from `7-zip[.]org`. - **Network egress review:** Identify any internal IPs appearing in residential proxy datasets. Cross-reference against known proxy IP feeds. ### P3 — Within 7 days - **User awareness:** Brief staff on the typosquatting vector (7zip\[.\]com vs. 7-zip\[.\]org) and the broader pattern of trojanized installers promoted through tutorial content and search results. - **Software sourcing controls:** Update software procurement and download procedures to require verification of publisher domains. Add the drop-catching technique to threat-modelling for software supply chain. - **Mobile app governance:** Review the mobile application allow-list and block apps from developer "WEILAI NETWORK TECHNOLOGY CO., LIMITED" pending verification. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------------- | ---------------------------------------------------------------- | ---------- | ---------------------------- | | domain | 7zip\[.\]com | High | Infoblox via The Hacker News | | url | iplogger\[.\]com/mnWD | High | Infoblox via The Hacker News | | domain | 7-zip\[.\]org (legitimate — use for allow-listing, not blocking) | High | Infoblox via The Hacker News | | android-app | wirevpn - Fast Unlimited Proxy | Medium | Infoblox via The Hacker News | | developer-name | WEILAI NETWORK TECHNOLOGY CO., LIMITED | Medium | Infoblox via The Hacker News | ```iocs domain 7zip[.]com url iplogger[.]com/mnWD domain 7-zip[.]org android-app wirevpn - Fast Unlimited Proxy developer-name WEILAI NETWORK TECHNOLOGY CO., LIMITED ``` ## 6\. Detection ```yara rule Lurking_Lizard_7zip_Installer_Campaign { meta: author = "Adverse Trace" date = "2026-07-09" reference = "https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html" description = "Detects artefacts associated with Lurking Lizard trojanized 7-Zip installer campaign" strings: $domain1 = "7zip.com" nocase $domain2 = "iplogger.com/mnWD" nocase $app1 = "wirevpn" nocase $dev1 = "WEILAI NETWORK TECHNOLOGY CO., LIMITED" nocase condition: 2 of them } ``` ```yaml title: Lurking Lizard Proxy Campaign - Network Connections to Known Malicious Infrastructure id: 7a3c1f2e-9b4d-4a8c-9e1f-0a2b3c4d5e6f status: experimental description: Detects network connections to domains and URLs associated with the Lurking Lizard residential proxy campaign references: - https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html author: Adverse Trace date: 2026/07/09 logsource: category: network_connection product: any detection: selection: DestinationHostname|endswith: - "7zip.com" DestinationHostname|contains: - "iplogger.com" selection_url: DestinationUrl|contains: - "iplogger.com/mnWD" condition: selection or selection_url falsepositives: - iplogger.com is a legitimate IP-logging service; consider scoping to the specific URL path level: high ``` ```yaml title: Lurking Lizard - WireVPN Android Application Installed id: 8b4d2g3f-0c5e-5b9d-af2g-1b3c4d5e6f7a status: experimental description: Detects installation of the WireVPN application associated with the Lurking Lizard proxy campaign references: - https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html author: Adverse Trace date: 2026/07/09 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - "wirevpn" condition: selection falsepositives: - Legitimate VPN client with similar name (unlikely) level: high ``` ## 7\. Sources - The Hacker News, "Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes," https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html, 2026-07-09 - Infoblox (cited via The Hacker News), DNS threat intelligence findings on Lurking Lizard, https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html - Proxyway (cited via The Hacker News), findings on SmartProxy/IPIDEA IP overlap, https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html ## 8\. Adverse Trace position This is a **medium-severity** advisory for EMEA financial services. No CVE is in scope and no CISA-KEV exploitation is referenced. The core risk is not direct data theft or ransomware but silent enrolment of corporate endpoints as residential proxy exit nodes — exposing the organisation's IP addresses to third-party criminal traffic, with attendant reputational, legal, and potential regulatory consequences. Attribution to "Lurking Lizard" as a China-based actor is unconfirmed (no MITRE ATT&CK profile; single-sourced to Infoblox WHOIS and infrastructure fingerprinting). The campaign's longevity (since August 2022), scale (230+ domains, 16M+ IPs in the proxy pool), and use of drop-catching and lookalike domains indicate a mature, well-resourced operation. We are treating the IOCs as actionable but note the full domain list is not publicly enumerated in the source — clients should request it directly from Infoblox. Adverse Trace will update this advisory if additional IOCs, malware family details, or the full lookalike domain list become available. --- [Read the original source →](https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*