A sophisticated operation has been discovered that utilizes fake software installers, specifically those mimicking the popular 7-Zip file archiver, to compromise user devices and enlist them into a large-scale proxy network. This campaign, attributed to a threat group identified as Lurking Lizard, has been active since at least August 2022 and has reportedly ensnared over 230,000 devices.
The primary vector for infection appears to be malicious websites distributing counterfeit versions of the 7-Zip installer. When unsuspecting users download and execute these fake installers, their systems are compromised, and they are silently added to the proxy network.
The Lurking Lizard group is leveraging these compromised devices to create a residential proxy network. This means that the internet traffic of unsuspecting users is being rerouted through their infected machines, masking the origin of malicious activities.
While the exact number of compromised devices is not definitively confirmed, reports indicate the network comprises a significant number of residential IP addresses, suggesting a widespread impact on individual users. The operation has been actively building this infrastructure over an extended period.
The purpose of this proxy network is to facilitate various illicit online activities. By routing traffic through a vast number of seemingly legitimate residential IP addresses, the threat actors can obscure their true location and identity, making it more difficult for law enforcement and cybersecurity professionals to track them.
The compromised 7-Zip installers are a key component of this operation. The threat actors are actively promoting these fake installers, likely through search engine optimization techniques or malicious advertisements, to lure victims into downloading them.
The scale of the operation, with over 230,000 devices reportedly involved, highlights the significant resources and planning undertaken by Lurking Lizard. The longevity of the campaign, dating back to August 2022, indicates a sustained effort to build and maintain this infrastructure.
The use of residential proxies is a concerning trend in cybercrime, as it allows attackers to impersonate real users and bypass security measures that might block traffic from known malicious IP addresses or data centers. This makes it harder to detect and prevent fraudulent activities, such as account takeovers, ad fraud, and the distribution of further malware.
