Background of the malicious 7-Zip installer, and assessing its Impact
Early in 2026, external researchers disclosed a malicious distribution campaign leveraging a trojanized installer masquerading itself as a legitimate 7‑Zip utility. Evidence suggests the campaign was active as of January 2026, during which victims were served a fake installer from 7zip[.]com, a highly convincing typo-squatted domain impersonating the official 7‑Zip distribution site (7-zip[.]org).
Initial access is typically achieved through social engineering and search‑engine abuse, including YouTube tutorial content that explicitly referenced the impersonated domain as the download source. Notably, several reports observed the installer delivered a modified but functional build of 7‑Zip (7zfm.exe) to reduce suspicion and preserve expected user behavior.
However, the installer also dropped additional payloads, such as Uphero.exe, hero.exe, and hero.dll, which are not part of the legitimate 7‑Zip software package. Once installed and executed, these payloads allow the attacker to establish persistence and configure the infected host as a proxy node under their control. This facilitates malicious activities such as traffic relaying, anonymizing infrastructure, and the delivery of secondary payloads [1] [2].
Overall, this attack illustrates a proxyware-style attack that abuses implicit trust in widely deployed third‑party tools while exploiting unconventional delivery vectors such as instructional media. By closely imitating legitimate software behavior and branding, the threat actors significantly reduced user suspicion and increased the likelihood of widespread, undetected compromise.
Threat overview
Darktrace observed multiple customers affected by the malicious 7‑Zip installer between January 12 and January 22, impacting organizations across the Americas (AMS), Asia‑Pacific & Japan (APJ), and Europe, the Middle East, and Africa (EMEA) regions. The activity targeted customers across various sectors, including Human health and social work activities, Manufacturing, Education, and Information and communication.
The following use case highlights a device on one customer network making external connections associated with malicious 7-Zip update activity observed between January 7 and January 18, 2026. This behavior included connectivity to the malicious domain 7zip[.]com, followed by command-and control (C2) activity involving "smshero"-themed domains, as well as outbound proxy connections over ports 1000 and 1002.
Initial Connectivity to 'update[.]7zip[.]com':
![Initial Beaconing to Young Endpoint alert behavior, involving the known tunnel/proxy endpoint ‘79.127.221[.]47’.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a0b527a7ecc78423d4fdbc6_Screenshot%202026-05-18%20at%2010.55.03%E2%80%AFAM.avif)
Starting on January 7, Darktrace / NETWORK detected the device making repeated beaconing connections to the endpoint 79.127.221[.]47 over the destination port 1000. The use of this port aligns with open-source intelligence (OSINT) reporting that hero[.]exe establishes outbound proxy connections via non-standard ports such as 1000 and 1002 [1].
![Darktrace observed TLS beaconing alerts to the known trojanized installer, update[.]7zip[.]com · 98.96.229[.]19, over port 443 on January 7th.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a0b529557224d073e49becd_Screenshot%202026-05-18%20at%2010.55.29%E2%80%AFAM.avif)
Later the same day, the device initiated TLS beaconing to the endpoint update.7zip[.]com. This is more than likely a common source of compromise, where victims unknowingly installed a modified build of the tool alongside additional malicious components. The campaign then progressed into the next attack phase, marked by established connectivity to various C2 domains.
Beaconing Activity to "smshero"-themed domains
Darktrace subsequently observed the same infected device connecting to various C2 domains used to retrieve configuration data. As such, these external hostnames were themed around the string “smshero”, for example ‘smshero[.]co’.
![On January 8th, Darktrace observed SSL beaconing to a rare destination which was attributed to a known ‘config/control domain’, nova[.]smshero[.]ai.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a0b52ca6bdc2e2e6451446a_Screenshot%202026-05-18%20at%2010.56.22%E2%80%AFAM.avif)
The following day, on January 8, the device exhibited its first connectivity to a "smshero"-themed endpoint, which has since been identified as being associated with rotating C2 servers [1] [3]. Similar beaconing activity continued over the following days, with Darktrace identifying C2 connectivity to update[.]7zip[.]com over port 443, alongside additional connections to “smshero”‑themed endpoints such as zest.hero-sms[.]ai, flux.smshero[.]cc, and glide.smshero[.]cc between January 9 and January 15.
![Darktrace later observed continued beaconing alerts over a 4-day interval to additional rare destinations attributed to a known ‘config/control domain’, zest[.]hero-sms[.]ai & glide[.]smshero[.]cc.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6a0b52eed2e7185a03c382e7_Screenshot%202026-05-18%20at%2010.56.59%E2%80%AFAM.avif)
Proxied connectivity over destination ports
The primary objective of this campaign is believed to be proxyware, whereby third-party traffic is routed through victim devices to potentially obfuscate malicious activity. Devices were also observed communicating with rare external IPs hosted on Cloudflare and DataCamp Limited ASNs, establishing outbound proxy connections over the non-standard ports 1000 and 1002 [1].
OSINT sources also indicate that connections over these ports leveraged an XOR-encoded protocol (key 0x70) designed to obscure control messages. While the end goal of the campaign remains unclear, residential proxy networks can be abused to evade security rules and facilitate further unauthorized activities, including phishing and malware distribution [1][3].
Specifically, on January 8, Darktrace observed the device engaging in low-and-slow data exfiltration to the IP 79.127.221[.]47, which had first been observed the previous day, over port 1000. Proxyware typically installs an agent that routes third‑party traffic through an end-user’s device, effectively turning it into a residential proxy exit node. This activity likely represents the system actively communicating outbound data to an entity that controls its behavior.
Similar activity continued between January 10 and January 18, with Darktrace detecting threat actors attempting to exfiltrate significant volumes of data to 79.127.221[.]47 over destination port 1000.
Throughout the course of this incident, Darktrace’s Cyber AI Analyst launched several autonomous investigations, analyzing each anomalous event and ultimately painting a detailed picture of the attack timeline. These investigations correlated multiple incidents based on Darktrace detections observed between January 7 and January 19. Cyber AI Analyst identified anomalous variables such as repeated connections to unusual endpoints involving data uploads and downloads, with particular emphasis on HTTP and SSL connectivity.
Darktrace’s Autonomous Response
At several stages throughout the attack, Darktrace implemented Autonomous Response actions to help contain the suspicious activity as soon as it was identified, providing the customer’s security team with additional time to investigate and remediate. Between January 7 and January 18, Darktrace blocked a wide range of malicious activity, including beaconing connections to unusual endpoints, small data exfiltration attempts, and larger egress efforts, ultimately preventing the attacker from progressing through multiple stages of the attack or achieving their objectives.
Conclusion
The malicious 7‑Zip installer underscores how attackers continue to weaponize trust in widely used, legitimate software to gain initial access while evading user suspicion. By exploiting familiar and commonly installed services, this type of attack demonstrates that even routine actions, such as installing compression software, can become high‑risk events when defenses or user awareness are insufficient.
This campaign further emphasizes the urgent need for strict software validation and continuous network monitoring. Modern threats no longer rely solely on obscure tools or overtly malicious behavior. Instead, they increasingly blend seamlessly into everyday operations, making detection more challenging.
In this case, Darktrace / NETWORK was able to identify the anomalous activity and Autonomous Response actions in a timely manner, enabling the customer to be quickly notified and providing crucial additional time to investigate further.
In summary, the abuse of a trojanized 7‑Zip installer highlights a concerning shift in modern threat tactics, where trusted and widely deployed tools can serve as primary delivery mechanisms for system compromise. This reality reinforces that proactive detection, continuous monitoring, and strong security awareness are not optional but essential.
Credit to Justin Torres, Senior Cyber Analyst, David Moreira da Silva, Cyber Analyst, Emma Foulger, Global Threat Research Operations Lead.
Edited by Ryan Traill (Content Manager)
Appendices
References
3. https://blog.lukeacha.com/2026/01/beware-of-fake-7zip-installer-upstage.html
5. https://customerportal.darktrace.com/guides/antigena-network-model-actions
Darktrace Model Detections
· Anomalous Connection / Data Sent to Rare Domain
· Anomalous Connection / Low and Slow Exfiltration to IP
· Anomalous Connection / Multiple Failed Connections to Rare Endpoint
· Anomalous Connection / Uncommon 1 GiB Outbound
· Anomalous Server Activity / Rare External from Server
· Compromise / Agent Beacon (Long Period)
· Compromise / Beacon for 4 Days
· Compromise / Beacon to Young Endpoint
· Compromise / Beaconing Activity To External Rare
· Compromise / High Volume of Connections with Beacon Score
· Compromise / Large Number of Suspicious Failed Connections
· Compromise / Large Number of Suspicious Successful Connections
· Compromise / Repeating Connections Over 4 Days
· Compromise / SSL Beaconing to Rare Destination
· Compromise / Suspicious TLS Beaconing To Rare External
· Device / Large Number of Model Alerts
· Unusual Activity / Unusual External Activity
Cyber AI Analyst Coverage
· Unusual Repeated Connections
· Unusual Repeated Connections to Multiple Endpoints
· Possible HTTP Command and Control
· Possible HTTP Command and Control to Multiple Endpoints
· Suspicious Remote Service Control Activity
· Possible SSL Command and Control to Multiple Endpoints
Indicators of Compromise
IoC - Type - Description + Confidence
· 7zip[.]com – Hostname – C2 Endpoint
· flux[.]smshero[.]co - Hostname - C2 Endpoint
· neo[.]herosms[.]co - Hostname - C2 Endpoint
· nova[.]smshero[.]ai - Hostname - C2 Endpoint
· zest[.]hero-sms[.]ai - Hostname - C2 Endpoint
· soc[.]hero-sms[.]co - Hostname - C2 Endpoint
· pulse[.]herosms[.]cc - Hostname - C2 Endpoint
· glide[.]smshero[.]cc - Hostname - C2 Endpoint
· prime[.]herosms[.]vip - Hostname - C2 Endpoint
· 172.96.115[.]226 - IP Address - C2 Endpoint
· 79.127.221[.]47:1002 – IP Address/Port - Proxy Endpoint
· 84.17.37[.]1:1002 - IP Address/Port - Proxy Endpoint
MITRE ATT&CK Mapping
Technique Name - Tactic - ID - Sub-Technique of
· Exfiltration Over C2 Channel - EXFILTRATION - T1041
· Scheduled Transfer - EXFILTRATION - T1029
· Automated Exfiltration - EXFILTRATION - T1020
· Data Transfer Size Limits - EXFILTRATION - T1030
· External Proxy - COMMAND AND CONTROL - T1090.002 - T1090
· Non-Application Layer Protocol - COMMAND AND CONTROL - T1095
· Non-Standard Port - COMMAND AND CONTROL - T1571
· Exfiltration to Cloud Storage - EXFILTRATION - T1567.002 - T1567
· Exploit Public-Facing Application - INITIAL ACCESS - T1190
· Web Protocols - COMMAND AND CONTROL - T1071.001 - T1071
· Application Layer Protocol - COMMAND AND CONTROL - T1071
· Man in the Browser - COLLECTION - T1185
· Browser Extensions - PERSISTENCE - T1176
· Encrypted Channel - COMMAND AND CONTROL - T1573
· Fallback Channels - COMMAND AND CONTROL - T1008
· Multi-Stage Channels - COMMAND AND CONTROL - T1104
· Supply Chain Compromise - INITIAL ACCESS ICS - T0862
· Commonly Used Port - COMMAND AND CONTROL ICS - T0885
