rarlab

Google on Tuesday revealed that multiple threat actors, including nation-state adversaries and financially motivated groups, are exploiting a now-patched critical security flaw in RARLAB WinRAR to establish initial access and deploy a diverse array of payloads. "Discovered and patched in July 2025, government-backed threat actors linked to Russia and China as well as financially motivated threat actors continue to exploit this n-day across disparate operations," the Google Threat Intelligence Group (GTIG) said. "The consistent exploitation method, a path traversal flaw allowing files to be dropped into the Windows Startup folder for persistence, underscores a defensive gap in fundamental application security and user awareness." The vulnerability in question is CVE-2025-8088 (CVSS score: 8.8), which was patched by WinRAR version 7.13 released on July 30, 2025. Successful exploitation of the flaw could allow an attacker to obtain arbitrary code execution by crafting malicious archive files that are opened by a vulnerable version of the program. ESET, which discovered and reported the security defect, said it observed the dual financial and espionage-motivated threat group known as RomCom (aka CIGAR or UNC4895) exploiting the flaw as a zero-day as far back as July 18, 2025, to deliver a variant of the SnipBot (aka NESTPACKER) malware. It's worth noting that Google is tracking the threat cluster behind the deployment of Cuba Ransomware, which is also known to use RomCom RAT, under the moniker UNC2596. Reports indicate potential connections between the operators of UNC2596, UNC4895, and a data extortion marketplace called Industrial Spy. Since then, the vulnerability has come under widespread exploitation, with attack chains typically concealing the malicious file, such as a Windows shortcut (LNK), within the alternate data streams (ADS) of a decoy file inside the archive, causing the payload to be extracted to a specific path (e.g., the Windows Startup folder) and automatically executing it once the user logs in to the machine after a restart. Some of the other Russian threat actors who have joined the exploitation bandwagon are listed below - Sandworm (aka APT44 and FROZENBARENTS), which has leveraged the flaw to drop a decoy file with a Ukrainian filename and a malicious LNK file that attempts further downloads Gamaredon (aka CARPATHIAN), which has leveraged the flaw to strike Ukrainian government agencies with malicious RAR archives containing HTML Application (HTA) files that act as a downloader for a second stage Turla (aka SUMMIT), which has leveraged the flaw to deliver the STOCKSTAY malware suite using lures centred around Ukrainian military activities and drone operations GTIG said it also identified a China-based actor weaponizing CVE-2025-8088 to deliver Poison Ivy via a batch script dropped into the Windows Startup folder that's then configured to download a dropper. "Financially motivated threat actors also quickly adopted the vulnerability to deploy commodity RATs and information stealers against commercial targets," it added. Some of these attacks have led to the deployment of Telegram bot-controlled backdoors and malware families like AsyncRAT and XWorm. In another case highlighted by Google's threat intelligence team, a cybercrime group known for targeting Brazilian users via banking websites is said to have delivered a malicious Chrome extension that's capable of injecting JavaScript into the pages of two Brazilian banking sites to serve phishing content and steal credentials. The broad exploitation of the flaw is assessed to have been the result of a thriving underground economy, where WinRAR exploits have been advertised for thousands of dollars. One such supplier, "zeroplayer," marketed a WinRAR exploit around the same time in the weeks leading to the public disclosure of CVE-2025-8088. "Zeroplayer's continued activity as an upstream supplier of exploits highlights the continued commoditization of the attack lifecycle," GTIG said. "By providing ready-to-use capabilities, actors such as zeroplayer reduce the technical complexity and resource demands for threat actors, allowing groups with diverse motivations [...] to leverage a diverse set of capabilities." The development comes as another WinRAR vulnerability (CVE-2025-6218, CVSS score: 7.8) has also witnessed exploitation efforts from multiple threat actors, including GOFFEE, Bitter, and Gamaredon, underscoring the threat posed by N-day vulnerabilities.

Researchers have released a report detailing how a recent WinRAR path traversal vulnerability tracked as CVE-2025-8088 was exploited in zero-day attacks by the Russian 'RomCom' hacking group to drop different malware payloads. RomCom (aka Storm-0978 and Tropical Scorpius) is a Russian cyberespionage threat group with a history in zero-day exploitation, including in Firefox (CVE-2024-9680, CVE-2024-49039) and Microsoft Office (CVE-2023-36884). ESET discovered that RomCom was exploiting an undocumented path traversal zero-day vulnerability in WinRAR on July 18, 2025, and notified the team behind the popular archiver tool. "Analysis of the exploit led to the discovery of the vulnerability, now assigned CVE-2025-8088: a path traversal vulnerability, made possible with the use of alternate data streams. After immediate notification, WinRAR released a patched version on July 30th, 2025," explains a new report published by ESET today. WinRAR released a fix for the flaw, which was assigned the identifier CVE-2025-8088, on July 30, 2025, with version 7.13. However, there was no mention of active exploitation in the accompanying advisory. ESET confirmed the malicious activity to BleepingComputer late last week, which was believed to be used to extract dangerous executables to autorun paths when a user opens a specially crafted archive. The vulnerability was similar to another path traversal flaw in WinRAR, disclosed a month earlier, tracked as CVE-2025-6218. ESET's report explains that the malicious RAR archives include numerous hidden ADS (Alternate Data Stream) payloads that are used to hide a malicious DLL and Windows shortcut, which are extracted into attacker-specified folders when the targets open the archive. Many of the ADS entries are for invalid paths, which ESET believes were deliberately added to generate harmless-looking WinRAR warnings, while concealing the presence of the malicious DLL, EXE, and LNK file paths deeper in the file list. The executables are placed into the %TEMP% or %LOCALAPPDATA% directories, while the Windows shortcuts (LNK files) are dropped in the Windows Startup directory so that they are executed upon subsequent login. ESET documented three distinct attack chains, all delivering known RomCom malware families: Mythic Agent – Updater.lnk adds msedge.dll to a COM hijack registry location, which decrypts AES shellcode and runs only if the system's domain matches a hardcoded value. The shellcode launches the Mythic agent, enabling C2 communication, command execution, and payload delivery. SnipBot – Display Settings.lnk runs ApbxHelper.exe, a modified PuTTY CAC with an invalid certificate. It checks for ≥69 recently opened documents before decrypting shellcode that downloads additional payloads from attacker servers. MeltingClaw – Settings.lnk launches Complaint.exe (RustyClaw), which downloads a MeltingClaw DLL that fetches and executes more malicious modules from the attacker's infrastructure. Russian cybersecurity firm Bi.Zone also reports observing a separate activity cluster, which they track as 'Paper Werewolf,' also leveraging CVE-2025-8088, as well as CVE-2025-6218, in attacks. ESET shared the complete indicators of compromise for the latest RomCom attacks on its GitHub repository. Although Microsoft added native RAR support to Windows in 2023, the feature is only available to newer releases, and its capabilities are not as extensive as those baked into WinRAR. Hence, many power users and organizations continue to rely on WinRAR for managing archives, which makes it a prime target for hackers. RarLab told BleepingComputer that they are not aware of the details of the exploitation of CVE-2025-8088, did not receive any user reports, and ESET only shared with them the technical information required to develop a patch. WinRAR does not contain an auto-update feature, so users need to manually download and install the latest version from here. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Rilevato sfruttamento in rete della CVE-2025-8088 relativa a WinRAR Alert AL01/250811/CSIRT-ITA Sintesi Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2025-8088 – già sanata dal vendor il 30 luglio 2025 – presente nel noto tool di compressione WinRAR di RARLAB. Tale vulnerabilità, qualora sfruttata, potrebbe consentire l’esecuzione di codice arbitrario sui dispositivi target tramite l’estrazione di un file da un archivio opportunamente predisposto. Note: un Proof of Concept (PoC) per lo sfruttamento della CVE-2025-8088 risulta disponibile in rete. Tipologia Remote Code Execution Prodotti e versioni affette WinRAR, versioni precedenti alla 7.13 Azioni di mitigazione Ove non provveduto, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti.

Rarlab heeft een kwetsbaarheid verholpen in WinRAR. De kwetsbaarheid bevindt zich in de Windows-versie van WinRAR en betreft een path-traversal. Deze fout stelt aanvallers in staat om willekeurige code uit te voeren door gebruik te maken van kwaadaardige archiefbestanden. Dit kan leiden tot ongeautoriseerde toegang en controle over de getroffen systemen. Uit publieke bronnen blijkt dat de kwetsbaarheid reeds actief is misbruikt.