Loading story…
ESET reported that the Russia-aligned RomCom group actively exploited the WinRAR zero-day CVE-2025-8088, a path traversal flaw involving Windows Alternate Data Streams that let malicious archives appear harmless while dropping files during extraction. The attacks used spearphishing emails with CV/resume-themed RAR attachments to target organizations in finance, manufacturing, defense, and logistics across Europe and Canada, and the exploitation chain deployed RomCom-associated tooling including a Mythic agent, a SnipBot variant, and RustyClaw/MeltingClaw downloaders. ESET said the flaw was fixed in WinRAR 7.13, warned that other actors also began exploiting it, and urged updates for WinRAR and downstream UnRAR.dll consumers.
Separate reporting from Trend Micro described 2025 intrusion campaigns tracked as SHADOW-VOID-042 that showed overlap with activity previously attributed to Void Rabisu/ROMCOM, though attribution remained unconfirmed. Those operations used tailored social-engineering lures aimed at executives and HR staff, and later impersonated Trend Micro browser security and Apex One updates against Trend Micro, a subsidiary, a partner, and other organizations. Recovered components showed a multi-stage chain using a Cloudflare-themed landing page, JavaScript exploiting CVE-2018-6065, delivery of an encrypted binary to C:\ProgramData\Microsoft\Windows\SystemProcessHost.exe, and persistence through a scheduled task running as SYSTEM; Trend Micro said early disruption prevented recovery of the final payload.
See which actors are running it and whether you're in range.
13 events from the most recent confirmed update back to the earliest known activity.
Trend Micro published research on two 2025 campaigns it tracks as SHADOW-VOID-042, noting overlaps with Void Rabisu/ROMCOM but saying attribution confidence was insufficient to merge them. The company said the final payload was not recovered and ROMCOM deployment could not be confirmed.
Trend Vision One quarantined most spear-phishing emails and blocked malicious landing pages in the November 2025 campaign, interrupting the infection chain before later-stage payload retrieval. Because of this early disruption, Trend Micro could not determine the final malware payload.
In November 2025, SHADOW-VOID-042 used Trend Micro-branded browser security and Apex One update lures against Trend Micro, its subsidiary, a partner, and organizations in other industries. The targets included executives and upper management in cybersecurity, energy, IT, and logistics.
In October 2025, the intrusion set Trend Micro tracks as SHADOW-VOID-042 used tailored social-engineering lures such as anonymous HR harassment complaints, research invitations, and questionnaires. The campaign targeted executives and HR personnel across multiple sectors.
ESET publicly reported that RomCom and another threat actor had exploited the WinRAR zero-day CVE-2025-8088, and said BI.ZONE had independently discovered the vulnerability. The report detailed the ADS-based path traversal technique and associated RomCom payload chains.
WinRAR 7.13 was published with a fix for CVE-2025-8088. ESET urged users and downstream consumers of UnRAR.dll and portable UnRAR source code to update.
ESET contacted WinRAR about CVE-2025-8088, and WinRAR fixed the issue the same day in WinRAR 7.13 beta 1. The patch addressed the zero-day affecting WinRAR and related Windows extraction components.
ESET researchers discovered a previously unknown WinRAR zero-day being exploited in the wild by RomCom. The flaw, later assigned CVE-2025-8088, is a path traversal issue involving Windows Alternate Data Streams.
From July 18 to July 21, 2025, ESET observed spearphishing campaigns targeting financial, manufacturing, defense, and logistics organizations in Europe and Canada using CV/resume lures and malicious RAR attachments. ESET said its telemetry did not show successful compromise of the observed targets.
ESET published research describing Mozilla and Windows zero-day and zero-click vulnerabilities exploited by the Russia-aligned RomCom group. The reference establishes a public disclosure by ESET of RomCom zero-day activity.
ESET cited RomCom's prior exploitation of CVE-2024-9680 chained with CVE-2024-49039 against Firefox, Thunderbird, and Tor Browser. This was noted as another major zero-day campaign preceding the WinRAR case.
ESET cited RomCom's prior in-the-wild exploitation of CVE-2023-36884 via Microsoft Word. This was presented as earlier evidence of the group's history of zero-day use.
Google patched Chrome vulnerability CVE-2018-6065 in version 65.0.3325.146. Trend Micro later found code exploiting this older flaw in recovered JavaScript from a 2025 intrusion chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourcewelivesecurity.com
Open sourceeset.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Google Threat Intelligence Group (GTIG)** reported ongoing, widening exploitation of a high-severity WinRAR path traversal flaw, **CVE-2025-8088**, roughly six months after it was disclosed and patched by RARLAB. GTIG assessed exploitation began as early as **July 18, 2025** (including activity nearly two weeks before the vendor fix) and has expanded across a diverse set of adversaries, spanning **Russia- and China-linked espionage actors** as well as **financially motivated cybercriminals**. Reported targeting includes military, government, and technology organizations, with multiple Russia-aligned operations focusing on **Ukrainian** entities. Technical reporting indicates the vulnerability abuses **Windows Alternate Data Streams (ADS)** within crafted archives to perform directory traversal and write files to arbitrary locations, including the Windows **Startup** folder for persistence. GTIG and other researchers describe exploit chains where a user opens a benign decoy (e.g., a PDF) while hidden ADS entries extract and drop executable content such as `LNK`, `HTA`, `BAT`, `CMD`, or script files that run at login; observed payloads include **remote access trojans, infostealers**, and malware frameworks used by named state actors (e.g., **RomCom/UNC4895**, **APT44**, **TEMP.Armageddon**, **Turla**) in addition to broader criminal activity across multiple regions.
Jun 29, 2026
Attackers abused the WinRAR remote code execution flaw **`CVE-2023-38831`** in spear-phishing campaigns that used crafted RAR archives to trigger malware execution when victims opened a decoy document. In one case, a phishing email impersonating a consultant from Russia’s Ministry of Industry and Trade targeted a major Russian semiconductor supplier and delivered the **Athena** agent from the **Mythic C2** framework. The archive paired a benign PDF with a malicious script disguised through the trailing-space filename trick tied to the WinRAR flaw; execution led to a PowerShell downloader, retrieval of a decoy PDF and payload from **`45.142.212.34`**, persistence via a scheduled task named **`aimp2`**, and command-and-control over Discord-backed channels. Ukraine’s **CERT-UA** separately reported active exploitation of the same vulnerability by **UAC-0057**, which used a malicious archive named **`Збірник_тез_НУОУ_23.rar`** to launch a chain involving a BAT file, an LNK shortcut, **`mshta.exe`**, and an embedded HTA file. That intrusion dropped a decoy PDF, executed JavaScript identified as a PicassoLoader variant, downloaded an SVG containing an encrypted .NET payload, decrypted it with the Rabbit algorithm, and ultimately deployed **Cobalt Strike Beacon**. The reports indicate that public proof-of-concept code and broad post-disclosure abuse have made **`CVE-2023-38831`** a practical delivery vector for multiple malware families and threat actors.
Aug 15, 2026
Google Threat Intelligence Group reported broad exploitation of **CVE-2025-8088**, a critical WinRAR path traversal vulnerability that lets attackers use malicious RAR archives with Windows Alternate Data Streams to write files to arbitrary locations. In observed attacks, the flaw was commonly used to drop payloads into the Windows Startup folder so malware would execute at the next user logon, giving intruders persistence after a victim opened a crafted archive. The activity has been linked to both state-backed and financially motivated actors, including clusters associated with Russia and China, with targeting focused on military, government, and technology organizations. Exploitation began as early as July 18, 2025, and continued after RARLAB released a fix in **WinRAR 7.13** on July 30, 2025, turning the issue into an actively abused n-day vulnerability; defenders were urged to patch quickly, keep archive software updated, and rely on protections such as Safe Browsing and Gmail filtering to block weaponized files.
Jun 29, 2026