NESTPACKER

NESTPACKER is malware delivered by the Russia-linked threat cluster UNC4895, also known as RomCom/CIGAR, and is externally known as Snipbot. Reported activity tied its delivery to spear-phishing campaigns targeting Ukrainian military units and broader Ukraine-focused operations. In the cited campaigns, attackers used tailored lures and malicious RAR archives exploiting the WinRAR path traversal vulnerability CVE-2025-8088 to gain initial access. The exploitation chain abused Windows Alternate Data Streams and directory traversal to write files to arbitrary locations, commonly the Windows Startup folder, enabling execution at user login and persistence. High-confidence reporting specifically states that UNC4895 used this technique to deliver NESTPACKER/Snipbot. The malware is associated in the reporting with Russian-linked operations focused on military and government targets in Ukraine. No additional technical capabilities, specific industries beyond the Ukraine military/government focus, or malware-specific IOCs were directly provided in the source content.