This method has been observed in campaigns primarily targeting organizations in Ukraine to distribute the SmokeLoader malware.
Files like ABHVIP.7z are often delivered via phishing emails or compromised websites. 📝 "Deep Dive" Research
Attackers use specifically crafted archive headers to trick 7-Zip into skipping the MoTW propagation.
A "deep paper" or technical analysis of this topic typically covers: