binarypublish
Key Points:
- A malicious version of 7ZIP is being used as a vector for spreading malware on the Microsoft App Store.
- Cybersecurity researchers found that the rogue 7ZIP package allowed hackers to compromise systems and potentially steal data.
- Despite having been removed from the App Store, it’s still unclear how attackers were able to upload the rogue package initially.
A recent warning has been issued regarding a malicious version of 7ZIP on the Microsoft App Store, following an investigation by cybersecurity researchers at the QiAnXin Threat Intelligence Center. This malware was found to be exploiting vulnerabilities in the popular file archiving software to spread malware and potentially compromise a large number of systems.
The problematic package, spotted by QiAnXin, was a fake Russian 7Zip, surfacing in “7z” searches on the Microsoft App Store. Upon its discovery, Microsoft acted swiftly by removing the software from its platform. Internally, the details of this incident were disclosed and indicators of compromise were shared publicly.
The rogue package, named UTG-Q-003, had initially bypassed detection since its appearance in January 2023 and remained unnoticed for almost a year. The exact process through which the attackers were able to upload this package to the Microsoft App Store remains a mystery. According to QiAnXin’s data platform, 7z-soft software was first downloaded on March 17, 2023.
The culprits behind the attack apparently employed a method of evasion through the use of JPHP, an open-source project that uses Java to run PHP code. Through this, they managed to fetch payloads from a remote server using the “jurl” function from the JPHP library.
Historical data showed that the affected domains hosting malware were primarily WordPress sites, suggesting that the UTG-Q-003 strain might have infiltrated WordPress. Despite their apparent removal, the malware still posed a threat through a deceptive verification dialog purportedly a Cloudflare DDoS protection, tricking victims and leading them to a malicious site. Even after closing the browser, Windows notifications continued to send the victims malicious links.
With phishing attacks surging following the disclosure of the vulnerability, the affected users were primarily pushed to the Microsoft App Store due to difficulty finding 7zip on official sites. The connection of the attacker domains to Russia and Ukraine adds further complexity, further compounding the challenge of attributing the attack, particularly in Russian-speaking regions.
