👾 Cyber Security - 7-Zip v24.09 (2024-11-29) addresses a serious vulnerability. Update if you haven't yet. -- ⚡ And change a setting!
7-Zip official website - https://7-zip.org/
This matters because I often recommend 7-Zip and I personally use it for everything. Also, the vulnerability reminded me of our still present TS4SCRIPT vulnerability.
"How did we get here?"
Well kemosabe, I got distracted from the Main Menu Override update, went down a rabbit hole trying to figure out how to decompile PYTHON - again for the umpteenth time - and found myself reading an article from a few months back written by someone at the SANS Internet Storm Center concerning a C++ PYTHON decompiler that looks promising, and that article led me to another article written by the same person concerning this 7-Zip vulnerability, which led me to this article.
I'm gonna finish my Main Menu Override update after I publish this. My pinky promises. 🩰
I've copypasted the "relevant" bits of the article but the gist is that the vulnerability allows malicious files contained in a ZIP within a ZIP to bypass security measures on Windows that are supposed to stop them from accidentally or intentionally being executed.
That's the best layman's summary I can do right now.
Now compare this to what we know about our TS4SCRIPT malware - it's a malicious PYTHON script inside of a TS4SCRIPT file (which is a ZIP archive) that is almost invisible because it's just code that only does a thing when the game executes the script - every time the game executes the script. That's the insidious and brilliant part of it; every time you launch the game, it executes the malicious script which then attempts to infect your device if it isn't already infected, or if the previous infection was quarantined. It only takes your "foolproof" premium anti-virus software mucking up once, and that's if it even catches it.
Where cybersecurity is concerned, nothing is foolproof, ever, period. That's why our applications and especially our anti-virus software is updated so often.
Malicious actors are not intellectually inferior to the folks creating and maintaining our security software. They are highly trained, very motivated, and sometimes backed by government agencies. They are not ever to be hand-waved away as "some moron with a grudge who has nothing better to do".
F.Y.I. There's no need to jump ship and stop using ZIP archives or 7-Zip. You just need to keep your 7-Zip up-to-date and be aware of what's going on.
⚡ When you're done updating, open 7-Zip and navigate to TOOLS » OPTIONS » 7-Zip (tab) » and change the dropdown setting for "Propagate Zone.ID stream" to YES » APPLY » OK and Bob's your uncle!
—
THE LINKED ARTICLE REFERENCES THE RUSSO-UKRAINE CONFLICT.
To say it plainly; cybersecurity don't give no !@#$s about your "political" views.
Also, my copypasting is out of order because I thought you might like to know what a "homoglyph attack" is first.
Y'know, back in the day it was just "Ensure you're on the correct website, noob!", but now the fakes are using characters that render the same as legits! THAT'S NOT THE SYMBOL OF HOPE, BRUH, IT'S A GODDAMN "S"! WHAT THE F- (╯'□')╯︵ ┻━┻
You'll see what I mean in a moment. 😹
⋆⋅ CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks:
Summary
In September, 2024 the Trend Zero Day Initiative™ (ZDI) Threat Hunting team identified the exploitation of a 7-Zip zero-day vulnerability used in a SmokeLoader malware campaign targeting Ukrainian entities.
The vulnerability, CVE-2025-0411, was disclosed to 7-Zip creator Igor Pavlov, leading to the release of a patch in version 24.09 on November 30, 2024.
CVE-2025-0411 allows the bypassing of Windows Mark-of-the-Web protections by double archiving files, thus preventing necessary security checks and allowing the execution of malicious content.
The vulnerability was actively exploited by Russian cybercrime groups through spear-phishing campaigns, using homoglyph attacks to spoof document extensions and trick users and the Windows Operating System into executing malicious files.
The vulnerability was likely exploited as a cyberespionage campaign against Ukrainian government and civilian organizations as part of the ongoing Russo-Ukraine conflict.
We provide recommendations for organizations to proactively secure their systems. This includes updating 7-Zip to at least version 24.09, implementing strict email security measures, and conducting employee training on phishing (including homoglyph attacks).
Recommendations
To minimize the risks associated with CVE-2025-0411 and similar vulnerabilities, we recommend that organizations adhere to the following best practices:
Ensure that all instances of 7-Zip are updated to version 24.09 or later. This version addresses the CVE-2025-0411 vulnerability.
Implement strict email security measures, including the use of email filtering and anti-spam technologies to detect and block spear-phishing attacks.
Train employees to recognize and report phishing attempts. Regularly update them on the latest phishing tactics, including homoglyph attacks on files and filetypes, as discussed in this entry.
Educate users on zero-day and n-day vulnerabilities and their role in preventing their exploitation.
Educate users on the importance of MoTW and its role in preventing the automatic execution of potentially harmful scripts or applications.
Disable the automatic execution of files from untrusted sources and configure systems to prompt users for verification before opening such files.
·Implement domain filtering and monitoring to detect and block homoglyph-based phishing attacks.
Use URL filtering to block access to known malicious domains and regularly update blacklists with newly identified threat domains.
Conclusion
It is important that everyone using 7-Zip update to 7-Zip version 24.09 immediately, especially since CVE-2025-0411 has been under active exploitation since at least September 2024, with PoC concepts existing as well.
⋆⋅ What are homoglyph attacks?
A homoglyph attack is a type of attack incorporating typographic manipulation using similar-looking characters to fool victims into clicking suspicious files or visiting malicious websites. These attacks are commonly used as part of phishing campaigns, where threat actors might use homoglyphs for spoofing legitimate websites to trick users into entering their credentials for credential harvesting. These credentials would then be employed as a pivot point to further compromise an organization.
As an example, an attacker may use the Cyrillic letter Es (which looks exactly like the Latin letter С or с) in a domain name such as api-miсrosoft[.]com, with “c” here being the “Es” character instead of the Latin one, to trick users into trusting this domain —perhaps to lure them into entering sensitive details such as usernames and passwords.
Figure 8. The letter c is replaced with the Cyrillic Es (с) homoglyph:
In Figure 8, the potential for deception presented by homoglyph characters is clearly demonstrated. A fully spoofed Microsoft domain has been created by substituting the Latin character “C” with the Cyrillic character “Es” (C). This typographic manipulation effectively misleads individuals into believing that they are accessing a legitimate Microsoft domain, thereby causing them to perceive the login screen as being part of an authentic site.
Figure 9. A real Microsoft login domain:
In Figure 9, the actual Microsoft login domain is depicted, with the actual Latin "C" character.
Although this domain features the TLS/SSL lock icon and the Microsoft favicon, these indicators alone are not always enough for verifying the domain's authenticity. A comprehensive analysis of the TLS certificate and additional technical specifics are often essential in substantiating the legitimacy of a domain. However, these technical elements can elude the average web user.
⋆⋅ CVE-2025-0411 - 7-Zip Mark-of-the-Web Bypass Vulnerability:
When a user downloads a file from an untrusted source, such as the internet, Microsoft Windows implements a security feature known as the Mark-of-the-Web (MoTW). This feature marks the local copy of the file by adding an NTFS Alternate Data Stream (ADS) named Zone.Identifier. Within this stream, the text ZoneId=3 is embedded, signifying that the file came from an untrusted zone, specifically the internet. This ensures that untrsuted files are not accidentally executed and allows the Windows operating system to perform extra security checks through Microsoft Defender SmartScreen.
CVE-2025-0411 allows threat actors to bypass Windows MoTW protections by double archiving contents using 7-Zip. Double archiving involves incapsulating an archive within an archive.
Figure 1. The Zone.Identifier of the outer encapsulated archive:
Figure 2. The Properties view of a file containing a MoTW:
A* MoTW designation helps prevent the automatic execution of potentially harmful scripts or applications by notifying the system and user to treat the file with caution and then directing it to perform additional analysis via Windows Defender SmartScreen.
Figure 3. Windows Defender SmartScreen Security warning prompted by MoTW:
Windows MoTW is an important part of the Windows security architecture and is needed for other key Windows protection mechanisms to function, such as:
Windows Defender SmartScreen, which examines files based on reputation and signature.
Microsoft Office Protected View, which protects users from threats such as malicious macros and Dynamic Data Exchange (DDE) attacks.
The root cause of CVE-2025-0411 is that prior to version 24.09, 7-Zip did not properly propagate MoTW protections to the content of double-encapsulated archives. This allows threat actors to craft archives containing malicious scripts or executables that will not receive MoTW protections, leaving Windows users vulnerable to attacks.
Figure 4. PoC demo of CVE-2025-0411 with encapsulated ZIP archive:
In Figure 4, the poc.bat file has no MoTW protections since it is encapsulated inside the poc.outer.zip\poc.inner.zip archive. This greatly increases the risk of infection and prevents Microsoft Windows Defender SmartScreen from performing reputation and signature checks.
Figure 5. Users are compromised once poc.bat is executed:
⋆⋅ The exploitation of CVE-2025-0411 via homoglyph attacks:
Earlier, we discussed a working PoC exploit of CVE-2025-0411 that used a nested archive structure such as poc.outer.zip/poc.inner.zip/poc.bat. In the samples we uncovered as part of the SmokeLoader campaign, the inner ZIP archive deployed a homoglyph attack to spoof a Microsoft Windows Document (.doc) file.
⋆⋅ In-the-wild: zero-day exploitation through homoglyph attacks:
[...] threat actors implemented an additional layer of deception to manipulate users into executing the zero-day vulnerability CVE-2025-0411.
By employing the Cyrillic character "Es", the attackers designed an inner archive mimicking a .doc file. This strategy effectively misleads users into inadvertently triggering the exploit for CVE-2025-0411, resulting in the contents of the archive being released without MoTW protections. Consequently, this allows for the execution of JavaScript files (.js), Windows Script Files (.wsf), and Windows Shortcut files (.url).
Using an example from the SmokeLoader campaign, "Документи та платежи.7z", translating to “Documents and payments” in English, serves as the outer zip archive and "Спiсок.doс", translated to “List”, serves as the inner archive.
This uses a homoglyph attack where the “c” in the “.doc” extension is a Cyrillic “Es” character.
⋆⋅ In-the-wild - contents of Спiсок.doс (inner archive):
Inside "Спiсок.doс", the .url file "Платежное Поручение в iнозеной валюте та сопроводiтельни документи вiд 23.09.2024p.url" points to an attacker-controlled server hosting another ZIP archive.
Figure 11. File properties of Платежное Поручение в iнозеной валюте та сопроводiтельни документи вiд 23.09.2024p.url:
As we can see in Figure 11, the file icon of "Платежное Поручение в iнозеной валюте та сопроводiтельни документи вiд 23.09.2024p.url" is spoofed to display a ZIP archive icon designed to further trick the user into executing the file. This file does not contain MoTW protections due to the exploitation of CVE-2025-0411.
⋆⋅ In-the-wild - contents of invoice.zip:
The archive file "invoce.zip" contains an executable "Платежное Поручение в iнозеной валюте.pdf.exe" disguised as a PDF document.
Figure 12. File properties of Платежное Поручение в iнозеной валюте.pdf.exe:
Once "Платежное Поручение в iнозеной валюте.pdf.exe" is executed, the SmokeLoader payload is also then executed, leading to malware infection and full system compromise.
⋆⋅ Indicators of Compromise:
Detection name:
Trojan.Win32.SMOKELOADER.D
Trojan.Win32.DOWNLOADER.BZ
Trojan.Win32.DOWNLOADER.BZ
TROJ_FRS.VSNTAV25
Trojan.WSF.SMOKELOADER.AA
Trojan.JS.SMOKELOADER.B
Trojan.Win32.FRS.VSNW1BJ24
TrojanSpy.Win32.STEALC.SMFRA
Trojan.Win32.FRS.VSNW1BJ24
TrojanSpy.Win32.STEALC.SMFRA
TROJ_FRS.0NA103JP24
TrojanSpy.Win32.STEALC.SMFRA
Trojan.WSF.SMOKELOADER.AA
Trojan.Win32.DOWNLOADER.BZ
SHA256 Detection name:
554d9ddd6fd1ccb15d7686c8badb8653323c71884c7f20efb19b56324ff34fc1
2e33c2010f95cbda8bf0817f1b5c69b51c860c536064182b67261f695f54e1d5
84ab6c3e1f2dc98cf4d5b8b739237570416bb82e2edaf078e9868663553c5412
54678013c8741db3340960e54ba93001c27619ead5cf5cc2eafd4c0fcf797ae6
62eb856a5f646c2883a3982f15c3eb877641f9e69783383ce8a73c688eccd543
cd123c288f623878218be31125000441bb8c5447375af67bc3c1d27d16eb5f8c
8ee225bdd38cf6fd014a16beb9e33a0650147a9b7ea2104afe2f47c01bd1db0b
a059d671d950abee93ef78a170d58a3839c2a465914ab3bd5411e39c89ae55a2
b3df042c5286fa91a4555e105038364bc66bfe7fdfe3769eb26b96e0ffe6096b
915b73a57aaf759fbd5352d79656e1b697545e6c9d953ab05aacf61ed4f6e397
d6d722ae73ddff1ad7c468feca882b159a2a6e267df8b219482b514cdab74c21
fdfbdd42944c9e3b9697a8d8375e4e5cfd45c86941aa3f8f6dd0d08607b73144
5c7d582ba61ac95fb0d330ecc05feeb4853ac1de1f5a6fd12df6491dd0b7ea34
888f68917f9250a0936fd66ea46b6c510d0f6a0ca351ee62774dd14268fe5420
URLs:
file[://]185[.]156[.]72[.]78/MyFolder/invoce[.]zip
hxxp[://]alfacentarusmulticopter[.]ru/index[.]php
hxxp[://]johnfabiconinteraption[.]ru/index[.]php
hxxp[://]storeagroculturnaya[.]ru/index[.]php
hxxp[://]alfacentarusmulticopter[.]ru/index[.]php
hxxp[://]storeagroculturnaya[.]ru/index[.]php
hxxp[://]johnfabiconinteraption[.]ru/index[.]php
hxxp[://]alfacentarusmulticopter[.]ru/index[.]php
hxxp[://]unicalads[.]ru/index[.]php hxxp[://]lazaretmed[.]pw/index[.]php
hxxp[://]technoads[.]pw/index[.]php hxxp[://]oncomnigos[.]online/index[.]php
hxxp[://]185[.]156[.]72[.]78/MyFolder/pay[.]zip
hxxp[://]southlander[.]ru/dklfhgjdfhgjd78khdgfjgh/akt[.]bat
hxxp[://]goodmastersportunicum[.]ru/load/svc[.]exe hxxp[://]ukr
netfilediscdownloadapplication[.]ru/file/download/6852365456384563846538458
5863874653786587365934/AKT_PAX_26_09_2024p[.]rarhxxps[://]ukr
netfilediscdownloadapplication[.]ru/file/download/6852365456384563846538458
5863874653786587365934/AKT_PAX_26_09_2024p[.]rar
Domains:
alfacentarusmulticopter[.]ru
johnfabiconinteraption[.]ru
storeagroculturnaya[.]ru
alfacentarusmulticopter[.]ru
storeagroculturnaya[.]ru
johnfabiconinteraption[.]ru
alfacentarusmulticopter[.]ru
unicalads[.]ru
lazaretmed[.]pw
technoads[.]pw
oncomnigos[.]online
southlander[.]ru
goodmastersportunicum[.]ru
ukr-netfilediscdownloadapplication[.]ru
IPv4:
185[.]156[.]72[.]78