0nb.7z (Direct - 2024)
: The campaign primarily targeted governmental and civilian organizations in Ukraine as part of the Russo-Ukrainian conflict.
: Older community discussions, such as those on Reddit , have debated the cryptographic implementation in 7-Zip, though many reported "flaws" were later deemed low-risk or debunked by the developer. 0NB.7z
On February 4, 2025, researchers at Trend Micro published a blog post detailing how Russian-linked threat actors exploited a zero-day vulnerability in 7-Zip, identified as . : The campaign primarily targeted governmental and civilian
: The vulnerability was used to deploy the SmokeLoader malware, which functions as a loader for further cyberespionage tools. : The vulnerability was used to deploy the
: Attackers used compromised email accounts to send malicious archives. These attacks utilized homoglyph attacks , where visually similar characters are used to deceive users into opening malicious files.