Lurking Lizard Uses Fake 7-Zip Installers for Malicious Proxy Operations

Discovery of Lurking Lizard

Researchers revealed details about a new threat actor called Lurking Lizard, which has been conducting operations to build a malicious residential proxy business. This entity uses an extensive network of over 230 fake domains to launch its attacks and recruit compromised devices into its proxy network.

Malicious Proxy Infrastructure

The operation employs a strategy that dates back to at least August 2022, where users are misled into downloading trojanized versions of software like 7-Zip from misleading domains such as '7zip[.]com'. The compromised devices are then used as proxy nodes in its infrastructure.

Key Operational Tactics

Lurking Lizard mimics established proxy providers like IPIDEA and SmartProxy, further amplifying its credibility by manipulating search traffic through fake independent review sites. Analysis indicates a method known as drop-catching, allowing them to acquire expired domains for legitimacy.

Broader Implications

The use of 7-Zip installers is only part of a larger campaign; similar tactics have been noted with other applications like WhatsApp and TikTok downloaders. Investigations have traced this behavior back to a China-based actor using multiple apps and services to mask their true intentions.

Concluding Notes

The proliferation of these malicious proxy networks poses a significant threat to cybersecurity, as they remain undetected and relay illegal activities. Users are advised to download software only from verified sources and be cautious with unsolicited links.