Threat Actors using ZIP smuggling technique to spread the malware

Dear @horsicq, I have found that DIE 3.21 doesn't detects ZIP smuggling, which is current exploitable technique by Mustang Panda APT Group:

The downloaded archives in these infection chains all use a ZIP smuggling technique to hide the next stage file within the ZIP structure. The ZIP files contain a single Microsoft shortcut (LNK) file that runs an embedded PowerShell command to search for the parent ZIP, then carve an MSI or TAR file from the ZIP using either a byte marker or hardcoded offset, and execute either the MSI or a DLL sideloading executable contained within the TAR. In all cases, this leads to a DLL sideloading triad loading PlugX.

Article by Proofpoint.

The tool's description:

This Python utility creates zip files that contain additional data embedded within the file structure. This extra data is not visible/does not display when the zip is examined or decompressed, but can be retrieved using powershell via a Windows shortcut file (LNK) within the zip file.

Tool's GitHub.

The sample is available for downloading fron Any Run (link).

Cound you please add some indicator so that virus analysts can know that there is additional data in the archive?