WinRAR 0-day that uses poisoned JPG and TXT files under exploit since April
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-20250 | Absolute Path Traversal in RARLAB WinRAR ACE Extraction (UNACEV2.dll) | 7.8 | 96% | KEVRansomwarePoC ×5 | KEV |
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion | 7.8 | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | catbox.moe | other cases, they were distributed on the file storage site catbox[.]moe. Group-IB identified eight popular trading forums used to |
From the original article
2 min read at arstechnica.com
A newly discovered zero-day in the widely used WinRAR file-compression program has been exploited for four months by unknown attackers who are using it to install malware when targets open booby-trapped JPGs and other innocuous inside file archives.
arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.