Russian Cybercrime Syndicates Exploiting Vulnerability in 7-Zip to Circumvent Windows Mark-of-the-Web Defenses

Exploitation of a recently fixed security weakness in the 7-Zip compression tool has been observed in the wild to distribute the SmokeLoader malware.
Dubbed CVE-2025-0411 with a CVSS score of 7.

Exploitation of a recently fixed security weakness in the 7-Zip compression tool has been observed in the wild to distribute the SmokeLoader malware.
Dubbed CVE-2025-0411 with a CVSS score of 7.0, the vulnerability enables malicious actors to bypass mark-of-the-web (MotW) protections and run unauthorized commands within the user’s operating context. 7-Zip resolved this issue in November 2024 through version 24.09.
“It was discovered that the security hole had been

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts