CTI · reviewed · 2026-09-30

OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX to Evade Detection

Full story & timeline

MITRE ATT&CK

• T1036 Masquerading Stealth
• T1116 Code Signing Stealth
• T1620 Reflective Code Loading Stealth
• T1105 Ingress Tool Transfer Command and Control

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://blog.gdatasoftware.com/2026/09/38490-opensupdater-evades-with-recompiled-7zip-sfx
• https://blog.google/threat-analysis-group/financially-motivated-actor-breaks-certificate-parsing-avoid-detection/
• https://cyberpress.org/opensupdater-conceals-loader-in-7-zip/