Russian APTs Still Exploiting Patched WinRAR Flaw CVE-2025
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-20250 | Absolute Path Traversal in RARLAB WinRAR ACE Extraction (UNACEV2.dll) WinRAR versions through 5.61 contain a path traversal flaw (CWE-22, also mapped to CWE-36) in the UNACEV2.dll library used to unpack ACE-format archives: when a crafted archive's filename field contains absolute-path patterns, WinRAR ignores the user-selected extraction destination and writes the file to any absolute path the attacker specifies. It is triggered by inducing a user to open a malicious ACE archive (user interaction required), allowing arbitrary file placement on the endpoint — for example, writing an executable to a Windows startup folder to achieve code execution at next logon, as demonstrated in the original Check Point research. Only RARLAB WinRAR is affected, and the issue was assigned by Check Point acting as CNA, with multiple public proofs of concept available. Exploitation is well established: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15) with known ransomware use (e.g., JNEC.a delivered via this exploit), has been linked to targeted-activity by threat actors, and EPSS currently assigns a 96.3% probability of exploitation within 30 days. Because WinRAR lacks an automatic update mechanism, stale installations remained exposed and under active attack long after the vendor fix was published. Do: Apply updates per vendor instructions by upgrading to a WinRAR release newer than 5.61, in which the vulnerable ACE handling is patched or replaced; ensure endpoints actually run the updated build given WinRAR does not auto-update. If patching cannot be done promptly, delete or neutralize UNACEV2.dll (disabling ACE extraction) or unpack ACE archives with a patched alternative, and scrutinize ACE attachments arriving via email. Hunt for unexpected files dropped into auto-run locations (e.g., startup folders) and treat this as a KEV entry with the corresponding federal remediation deadline. | 7.8 | 96% | KEV ransomware PoC ×5 |
| masshundreds of millions of Windows desktop installations (every WinRAR release up to 5.61 is vulnerable) | |
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution A path traversal flaw (CWE-35) in the Windows version of WinRAR allows attackers to achieve arbitrary code execution by delivering a specially crafted archive file that writes outside the expected location when it is opened or processed. Because the CVSS 4.0 vector indicates a local attack requiring user interaction, victims are typically infected by extracting or previewing a malicious archive received via phishing, a malicious download, or another delivery channel. A successful attacker gains the privileges of the user running WinRAR, providing an initial foothold that has been used for both espionage and ransomware operations. Anyone running the Windows version of WinRAR — one of the most widely deployed Windows desktop utilities — is affected, and CPE data additionally lists dtSearch as an affected vendor. Exploitation is confirmed in the wild by nation-state actors (e.g., the China-linked Amaranth-Dragon group per related reporting) and criminal actors including ransomware operators; the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-08-12 and carries a near-maximal 94.6% EPSS score. Do: Update WinRAR to the latest patched release from RARLAB on all Windows endpoints, prioritizing remediation per CISA KEV and BOD 22-01 requirements, and verify that dtSearch deployments bundling the affected component are also updated. Because exploitation requires a user to open or extract a crafted archive, warn users to treat unexpected archive files delivered by email or download with suspicion. Given confirmed ransomware use, hunt across user workstations — not just exposed servers — for suspicious archive-based infections and confirm the patched WinRAR version is installed. | 8.4 | 94% | KEV ransomware |
| masshundreds of millions of Windows users/devices (est.; RARLAB has historically claimed user counts in the hundreds of millions) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | malicious.workers.dev | itimate domains: a URL structured as hxxps://ssu[.]gov[.]ua@malicious[.]workers[.]dev displays the Security Service of Ukraine’s domain to th |
| domain | ssu.gov.ua | on to spoof legitimate domains: a URL structured as hxxps://ssu[.]gov[.]ua@malicious[.]workers[.]dev displays the Security Service |
| url | https://ssu[ | @-notation to spoof legitimate domains: a URL structured as hxxps://ssu[.]gov[.]ua@malicious[.]workers[.]dev displays the Security S |
Full article1,010 words · extracted from securityaffairs.com · click to collapse
Despite a 2025 patch, Russian-linked groups still exploit a WinRAR flaw (CVE-2025-8088) to deploy malware via phishing archives.
CVE-2025-8088 is a path traversal flaw in WinRAR that lets an attacker write files outside the extraction directory using NTFS Alternate Data Streams. WinRAR fixed it in version 7.13 in July 2025. Nearly a year later, Trend Micro researchers published an analysis showing two separate Russia-linked APT groups, Earth Dahu (aka Gamaredon) and SHADOW-EARTH-066 (UAC-0226), are still actively building new exploit samples and delivering fresh lure documents through it. The patch exists. The installations don’t have it.
The mechanics of the flaw are worth understanding precisely. Victims receive a RAR archive, typically via spear-phishing email. They open it and see a decoy PDF, something that looks like a Ukrainian court summons, a Ministry of Defense registry, or a military equipment manifest designed to create urgency.
In the background, with no warning and no additional user interaction, WinRAR silently writes hidden files to locations outside the extraction directory, including the Windows Startup folder. On the next login, those files execute automatically.
“WinRAR is deeply embedded in daily operations across Ukrainian organizations, making it an attractive target for exploitation. CVE-2025-8088 is a path traversal flaw (CVSS 8.4), patched in WinRAR 7.13 in July 2025, that allows an attacker to silently write files outside the extraction directory via NTFS Alternate Data Streams.” reads the report published by Trend Micro “Once the victim opens the archive, no further interaction is needed; they see only a decoy document. All the samples we analyzed exploit this vulnerability.”
SHADOW-EARTH-066’s current campaign represents a significant technical upgrade from its 2025 operations. The group originally used Excel macro droppers with hardcoded Telegram bot tokens in plaintext, a method that was trivially detectable.
The latest build, timestamped April 9, 2026, drops three hidden files via path traversal: an LNK shortcut into the Startup folder, a heavily obfuscated PowerShell loader into C:\ProgramData\, and a SUB-encoded DLL payload into the same directory. The PowerShell loader uses direct NT system calls to load the final DLL entirely in memory, never writing the decoded payload to disk, making file-based detection ineffective.
The final payload, internally named result.dll, is a direct evolution of GIFTEDCROOK and targets Chrome, Edge, Opera, and Firefox. It decrypts browser master keys, extracts passwords and session cookies, bypasses Chrome’s App-Bound Encryption, and scans Documents, Downloads, and TEMP directories for 35 file extensions covering documents, spreadsheets, presentations, KeePass databases, and OpenVPN config files. After exfiltrating everything to dedicated C2 servers via dual-layer RC4-encrypted HTTPS, it deletes all three staging artifacts from disk. One-shot execution, no persistence left behind.
“The stealer operates as a one-shot execution. After cleanup, no startup mechanism and no staging files remain on the endpoint.“ continues the report.
The shift from Telegram to dedicated C2 servers isn’t just a technical upgrade. In February 2026, Russia moved toward blocking Telegram domestically, which made hardcoded Telegram tokens increasingly unreliable as an exfiltration channel for operators working from Russian-adjacent infrastructure. The new C2 servers, seven IPs hosted on a Malaysian VPS provider with points of presence in France, the Netherlands, and Switzerland, communicate on non-standard high ports and all use the same URI path /rcv/, indicating shared server-side tooling across the campaign’s builds.
Earth Dahu’s approach is structurally different but uses the same entry point. Rather than a multi-file compiled stealer chain, Gamaredon drops a single HTA or VBScript file into the Startup folder via the same CVE-2025-8088 path traversal. On the next login, mshta.exe executes the HTA, which loads VBScript from external resources hosted through Cloudflare Workers and Dynamic DNS, then delivers espionage modules depending on the target.
“Since at least September 2025, Earth Dahu has also incorporated CVE-2025-8088 into its operations.” continues the report. “We first reported on this adoption in a private intelligence report distributed through TrendAI Vision One™︎ in December 2025, when Earth Dahu used the vulnerability with an HTA-to-VBScript infection chain that delivered espionage modules. Based on RAR internal file timestamps and file naming conventions, the chain remained active through at least April 10, 2026.”
ClearSky has also reported a wiper component delivered through the same chain.
Earth Dahu’s spear-phishing emails show operational sophistication at the delivery layer. Many were sent from compromised accounts on Ukrainian government Exchange servers, with one cluster showing four separate accounts originating from the same internal IP, pointing to a single compromised workstation distributing email through multiple mailboxes. The C2 URLs embedded in HTA files use HTTP basic-auth @-notation to spoof legitimate domains: a URL structured as hxxps://ssu[.]gov[.]ua@malicious[.]workers[.]dev displays the Security Service of Ukraine’s domain to the left of the @ while routing traffic to the attacker’s Cloudflare Workers subdomain. Spoofed domains span Ukrainian government sites, major news outlets, the BBC, and Deutsche Welle.
The two campaigns share an entry point but nothing else. SHADOW-EARTH-066 uses compiled C++ with static libcurl, direct NT syscalls, and direct IP-based C2. Earth Dahu uses script-based tooling, HTA and VBScript, proxied through Cloudflare Workers. No shared infrastructure connects them. Both decided independently that CVE-2025-8088 was worth building around.
The reason both keep using it is structural. WinRAR doesn’t auto-update. It’s not covered by Group Policy or centralized enterprise patch management like WSUS, SCCM, or Intune. Verifying patch status across an organization requires third-party tooling or manual auditing. This is exactly the profile threat actors look for: widely installed, infrequently updated, outside standard patch channels. CVE-2018-20250, a WinRAR vulnerability disclosed in 2018, was still showing up in targeted attacks years later. The pattern repeats.
“Despite CVE-2025-8088 was patched in WinRAR 7.13 in July 2025, yet at the time of writing, multiple threat actor groups continued to build new exploit samples with fresh lure documents and use this vulnerability as a reliable initial access vector against Ukrainian organizations.” concludes the report. “The convergence of both established state-backed groups and independently tracked clusters on a single vulnerability reflects the scale of the cyber threats that Ukraine faces.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/193476/apt/russian-apts-still-exploiting-patched-winrar-flaw-cve-2025-8088.html