A new cyber‑crime group called Lurking Lizard has been deploying counterfeit 7‑Zip installers to turn compromised computers into residential proxy nodes. Researchers first observed the activity in August 2022, and the campaign now spans more than 230 look‑alike domains. The operation targets users worldwide, exploiting the popularity of the legitimate compression tool.
The attackers host malicious binaries on domains that mimic the official 7‑Zip website. When victims download and run the fake installer, it silently installs a lightweight backdoor and configures the host as a proxy server. The proxy traffic is then sold to clients seeking to mask their online identity or bypass geo‑restrictions. By using residential IP addresses, the service evades many security filters that flag data center ranges. Researchers say the infrastructure is fully automated, allowing the group to scale quickly without direct human oversight.
The malicious installers are signed with valid certificates, giving them an appearance of legitimacy. Once executed, the payload drops a small DLL that registers itself as a system service. The service establishes an outbound connection to a command‑and‑control server, which issues proxy configuration commands. The backdoor also includes a self‑deletion routine to erase traces after successful deployment. According to the security team, the entire process takes under a minute, leaving users unaware of any performance impact. The group monetizes the proxy nodes by leasing them to advertisers, fraud rings, and other illicit actors who need to disguise their traffic origin.
Yes, users can reduce the risk by verifying download sources and employing reputable security software. Always obtain 7‑Zip from the official website or trusted repositories, and check the digital signature before installation. Enabling multi‑factor authentication on critical accounts adds an extra barrier if a compromised device is used to launch attacks. Organizations should monitor outbound proxy traffic for unusual patterns, such as sudden spikes in connections to foreign IP ranges. Network segmentation can also limit the spread of any infected host within a corporate environment.
The emergence of Lurking Lizard highlights the growing market for residential proxy services and the lengths attackers will go to supply them. As the campaign matures, security teams expect more sophisticated evasion techniques and broader targeting of high‑value users. Ongoing collaboration between researchers and industry partners will be essential to dismantle the underlying infrastructure and protect end users from similar threats.
What makes the fake 7‑Zip installers difficult to detect? The installers are signed with legitimate certificates and mimic the appearance of the official software, which often bypasses basic security checks.
How can organizations identify infected machines within their network? Look for unexpected outbound connections to proxy servers, irregular DNS queries to the identified look‑alike domains, and the presence of unknown services running under system accounts.
Is there any legal recourse for victims whose devices are turned into proxy nodes? Victims can report the intrusion to law enforcement and may pursue civil action if they can prove financial or reputational harm caused by the unauthorized use of their IP addresses.