Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Uphero/hero trojanized 7-Zip installer proxyware activity

Malware Activity
First reported
Last updated
Happening score
H score 15
1 unique sources, 1 articles

Summary

Hide ▲

A trojanized 7-Zip installer is now dropping Uphero/hero payloads that turn Windows hosts into residential proxy nodes, letting attackers route traffic through victim IP addresses. The delivery uses a fake 7-Zip website and appears to be part of a broader operation that also impersonates HolaVPN, TikTok, WhatsApp, and Wire VPN. The malware pulls configuration from rotating smshero C2 domains and uses DNS-over-HTTPS and Cloudflare to make detection harder.

Related Happenings

Google integrates Rust DNS parser into Pixel modem firmware

Security Tool/Service
H score11 First: 14.04.2026 13:21 Last: 14.04.2026 13:21 Sources 1

About this happening: Google is integrating a Rust-based DNS parser into Pixel modem firmware, reducing memory-safety risk in a remote cellular attack surface. The change matters because th...

Open Happening

ModeloRAT DNS-delivered malware staging

Malware Activity
H score22 First: 16.02.2026 02:29 Last: 16.02.2026 02:29 Sources 1

About this happening: ModeloRAT is now being delivered through a DNS-based staging chain, increasing the chance that malicious traffic blends into ordinary name-resolution activity. In the obse...

Open Happening

Roskomnadzor blocks WhatsApp in Russia

Public Sector Action
H score30 First: 13.02.2026 00:57 Last: 13.02.2026 00:57 Sources 1

About this happening: Roskomnadzor is trying to block WhatsApp in Russia, escalating restrictions on communication platforms and limiting access for users who rely on the service. The move...

Open Happening

Atomic MacOS Stealer (AMOS) distribution through AI-app lures, SEO poisoning, and supply-chain abuse

Malware Activity
H score31 First: 12.02.2026 16:25 Last: 12.02.2026 16:25 Sources 1

About this happening: Atomic MacOS Stealer (AMOS) is being distributed to macOS users through ClickFix-style Terminal prompts that silently download, mount, and launch DMG payloads. In...

Open Happening

ISPsystem VMmanager Windows VM abuse for payload delivery and C2

Malware Activity
H score22 First: 05.02.2026 22:57 Last: 05.02.2026 22:57 Sources 1

About this happening: The abuse of ISPsystem VMmanager is letting ransomware operators run Windows VMs that deliver payloads and support C2 infrastructure, reducing visibility and slowing t...

Open Happening

Timeline

  1. 10.02.2026 21:12 2 articles · 5mo ago

    Fake 7-Zip installer delivers Uphero/hero proxyware

    Initial Disclosure

    A fake 7-Zip website at 7zip[.]com is distributing a trojanized installer that keeps the 7-Zip program but drops Uphero.exe, hero.exe, and hero.dll, creates a SYSTEM auto-start service, and modifies firewall rules so infected Windows hosts can operate as residential proxy nodes. Malwarebytes analysis links the payload to rotating hero/smshero C2 domains, Cloudflare-backed TLS traffic, DNS-over-HTTPS via Google’s resolver, host profiling, and anti-analysis checks, and notes that the same operation also uses trojanized installers for HolaVPN, TikTok, WhatsApp, and Wire VPN.

    Show sources
    Open in new tab