Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes

Cybersecurity researchers have identified a threat actor known as Lurking Lizard, which operates a malicious residential proxy business. This business uses an infrastructure that includes over 230 domains that appear to be legitimate. The activity has been ongoing since at least August 2022, according to Infoblox, a DNS threat intelligence firm. One campaign involved fake 7-Zip installers that were used to compromise devices, which were then turned into residential proxy nodes. The threat actor's infrastructure is designed to support this end-to-end malicious business. Lurking Lizard's operations were observed as recently as earlier this year.