Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes

Summary

A threat actor named Lurking Lizard operates a residential proxy business using fake 7-Zip installers and over 230 lookalike domains. The group impersonates proxy providers and uses drop-catching techniques to legitimize its infrastructure. This operation spans victim acquisition, proxy infrastructure, marketing, and monetization.

Key Takeaways

1. A threat actor dubbed Lurking Lizard operates an end-to-end malicious residential proxy business using an infrastructure comprising more than 230 lookalike domains.
2. Lurking Lizard is also known to impersonate major proxy providers, including IPIDEA, SmartProxy (now Decodo), IP Royal, and 911Proxy, not to mention going to the extent of running fake "independent" review sites to drive traffic to its own scam storefronts.
3. The use of WireVPN branding represents the latest evolution of the campaign, using a multi-pronged approach to target users across operating systems, including Android, macOS, and Windows.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on cybersecurity research and expert analysis from Infoblox and Proxyway. It presents factual information about a threat actor's operations and technical details. While it speculates on motivations, the core claims are grounded in observed data.

Bias assessment: Technical Security Reporting. The article focuses on technical details of a cybersecurity threat, presenting information objectively. It avoids emotional language or partisan framing, prioritizing factual reporting of a malicious operation and its methods.

Note: This article provides a technical analysis of a cybersecurity threat. Readers should consider the source's expertise in cybersecurity and the factual basis of the claims presented.

Credibility flag: Technical Analysis

Claimed Facts (7)

• This is a direct statement of fact about the discovery and nature of the threat actor's operations.
• This provides a specific timeframe for the threat actor's activity, attributed to a named intelligence firm.
• This describes a specific observed campaign and its technical execution, presented as a factual account.
• This presents findings from technical analysis (WHOIS, fingerprinting) to attribute the actor's origin and identify decoy services.
• This describes a specific, documented technique used by the threat actor.
• This details specific technical evidence linking different malicious activities to a common infrastructure.
• This provides context by referencing a recent, related action by a major tech company concerning similar threats.

Opinions (7)

• This is a statement attributed to Infoblox, describing how victims were directed, which is an interpretation of observed behavior.
• This expresses uncertainty and a potential hypothesis about user acquisition methods, characteristic of an opinion or assessment.
• This statement expresses a lack of definitive knowledge and poses questions about the scope of the malware's functionality.
• The phrase "appears to be" indicates an interpretation and assessment rather than a definitively proven fact.
• The phrase "struck by the parallels" indicates an observation and interpretation of similarities, which is an opinion.
• This is a commentary on the perceived simplicity versus the actual complexity of the issue, framed as an opinion.
• This is an analytical statement summarizing the threat actor's comprehensive operational approach, which is an interpretation of their activities.

Claims (3)

• The claim of "more than 1 million downloads" is presented with a significant caveat that their organic nature is unclear, making the download number itself potentially misleading or unsubstantiated in its implication of genuine user adoption.
• While the risks are generally understood in cybersecurity, the phrasing "serious risks" and "launchpad for hacking and other unauthorized activities" uses strong, potentially alarmist language without specific examples in this context.
• This statement presents a potential consequence with a degree of certainty that might be an oversimplification of how IP flagging and blocking mechanisms operate, which can be nuanced.

Key Sources

• The Hacker News — Cybersecurity News Outlet
• Infoblox — DNS Threat Intelligence Firm
• Proxyway — Proxy Research Firm
• Google — Technology Company
• WEILAI NETWORK TECHNOLOGY CO., LIMITED — U.K.-based Firm