WinRAR

WinRAR is a legitimate file archiving utility that appears in the provided reporting primarily as a dual-use tool abused by threat actors for collection and staging of data prior to exfiltration. Across multiple incident reports, attackers installed or brought WinRAR into victim environments and used it to collect targeted files into RAR archives, including password-protected archives. In Akira ransomware intrusions, WinRAR was used to stage data for exfiltration, including use of the -hp flag to create password-protected archives such as data.rar through data6.rar from targeted document types on the D: drive. Field Effect also documented WinRAR as part of Akira activity targeting SonicWall SSL VPN environments and mapped its use to ATT&CK T1560.001 (Archive via Utility). Huntress likewise observed an intrusion likely tied to compromised SonicWall VPN access in which the threat actor staged data for exfiltration using WinRAR before later deploying a VMware ESXi exploit toolkit. NCC Group reported WinRAR being installed on a file server during an Everest ransomware incident to archive data for exfiltration, consistent with double-extortion activity. The FBI-led advisory on DPRK Andariel also lists WinRAR among open-source or dual-use tools used by the group. The content additionally references malicious WinRAR self-extracting archives (SFX) as a delivery mechanism in social-engineering activity, and one report claims Bitter APT attacks targeting China and Pakistan leveraged a WinRAR zero-day together with an Office macro and a new C# backdoor. High-confidence behavior directly supported by the content is that WinRAR is commonly used by threat actors to archive and password-protect stolen data in preparation for exfiltration.