A serious vulnerability in the widely-used archiving utility 7-Zip (CVE-2025-0411) has been recently patched with the release of version 24.09. This flaw was actively exploited by Russian cybercrime groups to launch targeted attacks against Ukrainian organizations, amidst the ongoing conflict between the two countries.
The vulnerability enabled attackers to bypass the Windows Mark-of-the-Web (MotW) protections, which are designed to prevent the execution of potentially harmful files downloaded from the Internet. By leveraging this flaw, cybercriminals were able to double-archive malicious payloads, evading built-in security mechanisms.
The attacks primarily involved spear-phishing campaigns utilizing compromised email accounts to distribute SmokeLoader malware. By embedding executable files within nested archives, the attackers successfully masked malicious content, making it harder for security systems to detect the threat.
Compounding these efforts, the cybercriminals implemented homoglyph attacks—manipulating characters in URLs and email addresses to deceive targets, further increasing the success rate of their phishing messages. This sophisticated approach led to significant cyberespionage activities against Ukrainian entities during this period.
In light of these developments, it is imperative for users to update to the latest version of 7-Zip (24.09) to mitigate the risk posed by this vulnerability. Additionally, organizations are advised to enforce strict email filtering policies to block such threats and provide adequate training to employees on recognizing phishing and homoglyph attacks.
Prompt updates and enhanced vigilance are essential in defending against these advanced cyber threats, ensuring that both organizational and personal data remain secure.

Collections

A recently patched vulnerability in 7-Zip (CVE-2025-0411) was exploited by Russian cybercrime groups to target Ukrainian organizations. This flaw allowed attackers to bypass Windows Mark-of-the-Web protections by double-archiving malicious payloads. The attacks involved spear-phishing campaigns using SmokeLoader malware, alongside homoglyph attacks to deceive targets. Users are urged to update to 7-Zip version 24.09 and enforce strict email filtering to mitigate risks.

Russian Cybercrime Groups Exploit 7-Zip Vulnerability to Bypass Windows MotW Protections