APTMembers
APT

7-Zip Wrapper Hides Decade-Old KMS Activation Cracker

Four Windows hacktools submitted between 2016 and 2019 all trace to the same pirated-activation toolset lineage — kmsauto, autokms, kmsactivator, hackkms. One variant borrows the real 7-Zip self-extractor's product metadata wholesale to smuggle a KMS-cracking payload past detection.

Jul 29, 2026, 14:14 (UTC+9)Last seenJul 29, 2026Severity100ByCTX TeamActorAPT27TEMP.HippoIOC4MITRE16

Four Windows hacktools submitted to detection engines between 2016 and 2019 all trace back to the same cracking-tool lineage — kmsauto, autokms, kmsactivator, hackkms — the commodity ecosystem that has quietly sustained pirated Windows and Office activation for the better part of a decade. The most newsworthy fact in this cluster isn't who built it.

Members only

Members-only article

This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.

Sign in to read
Source: CTX Threat Intelligence