🧰 7-Zip

The items that name it 6

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeupas affected products2026-09-28

  Legitimate components (7-zip.chm, 7-zip.dll, 7-zip32.dll, 7z.exe) bundled in NeedyMantis file archive

• Socket: Operation Muck and Load
  writeupas tools2026-07-16It is written here as 7-Zip (7zrr.exe).

  Command-line archive extractor staged by the loader at C:\ProgramData\zipathh\7zrr.exe to extract the password-protected Quixo.7z archive.

• Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft | Huntress
  writeupas tools2026-05-20

  Used by ransomware actors to stage/compress data into encrypted archives before exfiltration

• Decoding NightSpire: Ransomware IOCs Aren't Set in Stone
  writeupas tools2026-04-07It is written here as 7Zip.

  Used by the threat actor to archive files from a specific folder for data staging/collection

• Data Exfiltration and Threat Actor Infrastructure Exposed
  writeupas tools2026-03-12It is written here as 7Zip.

  Application used by threat actors for data staging

• Sigma r2026-07-01 — 20 new detection rules
  repoas toolsIt is written here as 7-Zip (including 7zr.exe).

  Archive utility; multiple rules updated to add missing 7zr.exe OriginalFileName entries for compression/exfiltration/extraction detection