Hackers are using a sophisticated strategy called ZIP file merging to specifically target Windows users. This method combines multiple ZIP files into a single file, making it harder for security software to detect malicious content.
See also: Hidden Risk: North Korean hackers BlueNoroff target crypto companies
As a result, unsuspecting users may accidentally download malicious files while believing they are accessing secure, compressed data. This tactic allows attackers to bypass traditional security measures and deliver malware undetected, posing significant risks to both individuals and organizations.
By exploiting the way different ZIP readers process concatenated files, hackers can embed malicious payloads into files that evade detection by many standard tools .
The merging of ZIP files involves adding multiple ZIP files into a single file. While this combined file appears as one file, it actually contains many root directories, each pointing to different sets of files.
According to Perception Point, the key to this technique lies in the way different ZIP readers interpret the concatenated structures. Some readers may only display the contents of one file while ignoring the others, allowing hidden malicious files to pass unnoticed.
See also: Georgia hospital hackers threaten to leak data
For example, if hackers combine two ZIP files—one containing benign content and the other containing malware—some tools will only display the harmless files. This inconsistency in handling allows attackers to hide their payloads from detection tools that rely on specific ZIP readers.
Popular ZIP readers such as 7zip, WinRAR and Windows File Explorer handle ZIP files differently:
- 7zip: When you open a ZIP file with 7zip, only the contents of the first file are displayed. While 7zip may display a warning about additional data after the end of the file, this is often ignored by users.
- WinRAR: Unlike 7zip, WinRAR reads the second main directory and reveals all the contents, including any hidden malicious files. This makes it more effective at detecting threats embedded in merged files.
- Windows File Explorer: The built-in Windows archiver has difficulty with concatenated ZIPs. In some cases, it may fail to open the file completely or display only part of the file's contents. This inconsistency makes it unreliable for detecting hidden threats.
A recent attack highlights how hackers are exploiting the ZIP file bundling technique to spread malware. In this case, a phishing disguised as a shipping notification was sent to victims, the report.
See also: FBI asks for public help – Wants information on Chinese hackers
Undetected attacks pose a significant threat to cybersecurity ,as they often infiltrate systems without raising an immediate alarm. These covert tactics can collect sensitive information, extract valuable data, or disrupt operations for extended periods before being detected. Attackers may use sophisticated methods such as zero-day exploits, polymorphic malware, or advanced persistent threats (APTs) to bypass traditional security measures. Consequently, organizations must adopt proactive strategies, regularly updating and strengthening their security infrastructure to effectively detect and mitigate these stealth attacks. Advanced technologies such as machine learning and behavioral analysis are increasingly integral to identifying anomalies that could indicate an undetected attack.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
