#2719 Abuse report: malicuous attack vector trying to download older version 7z1900-x64.exe

[Jari Aalto]

Abuse Report: Direct 7z1900-x64.exe Download Link Abused in Adware/PUP Bundling Campaign

I am writing to report the malicious abuse of official 7-Zip download infrastructure by an adware and SEO-poisoning campaign.

Context: Rogue download wrappers are utilizing official 7-Zip binaries either as extraction tools for payloads or as deceptive decoys to establish false legitimacy.

INCIDENT DESCRIPTION

A typosquatted domain impersonating an open-source tool https://smartmontools.com is distributing a deceptive wrapper ("SMART attribute download manager") instead of the legitimate software. This wrapper installs a leftover internet shortcut (*.exe.lnk[1]) that silently pulls an older, direct 7-Zip installer from your official server:

Abused URL: https://www.7-zip.org/a/7z1900-x64.exe

ACTIONS

Consider removing older binaries like 7z1900-x64.exe from third-party ad-network access.

[1] Details of the Windows "smart attribute monitoring.exe.lnk"

hortcutName     : smart attribute monitoring.exe.lnk
FullPath         : C:\Users\User\Downloads\smart attribute monitoring.exe.lnk
TargetPath       : https://www.7-zip.org/a/7z1900-x64.exe
TargetType       : URL / Web Address (Internet Shortcut Target)
TargetExists     : True
ExtractedURLs    : https://www.7-zip.org/a/7z1900-x64.exe
Arguments        :
WorkingDirectory :
Description      : Discription
WindowStyle      : 1
IconLocation     : C:\Users\User\AppData\Local\Temp\3g6k19QG,0
TargetLocation   :