Loading story…
Attackers are exploiting CVE-2025-8088, a path traversal vulnerability affecting WinRAR versions earlier than 7.13, to gain initial access through malicious RAR archives delivered by spear-phishing. Crafted archives write payloads outside the intended extraction directory, potentially enabling arbitrary code execution through shortcuts or other launch mechanisms. Italy’s CSIRT reported active exploitation in August 2025, following RARLAB’s July 30 patch release, and noted that a public proof-of-concept exploit was available.
Threat Landscape subsequently reported multiple unnamed intrusion sets using the flaw to deploy Amaranth Loader, with follow-on tooling including the Havoc framework and a Telegram-controlled remote access trojan. The campaigns conceal payloads using Alternate Data Streams and employ HTTPS, commercial CDN fronting, geofencing, and short-lived domains to reduce exposure to scanning and sandbox analysis. Continued exploitation despite the available fix makes updating all vulnerable WinRAR installations to version 7.13 or later a priority; defenders should also investigate suspicious archive extraction, unexpected file writes, and shortcut-triggered execution.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
RARLAB patched CVE-2025-8088 on July 30, 2025. The vulnerability affects WinRAR versions earlier than 7.13 and can enable arbitrary code execution when a specially crafted archive is extracted.
Multiple unnamed intrusion sets were observed exploiting CVE-2025-8088 through spear-phishing RAR attachments to deploy Amaranth Loader, with follow-on tooling including Havoc and a Telegram-controlled remote access trojan. The campaigns concealed payloads using Alternate Data Streams and used CDN-fronted, geofenced command-and-control infrastructure.
CSIRT Italia reported that a proof-of-concept exploit for CVE-2025-8088 was publicly available online.
CSIRT Italia reported that active exploitation of CVE-2025-8088 had been detected in the wild. The advisory recommended updating vulnerable WinRAR installations according to the vendor's security bulletin.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
threatlandscape.io
Open sourceacn.gov.it
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the WinRAR path traversal vulnerability, CVE-2025-6218, to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. This flaw, which affects Windows-based versions of WinRAR prior to version 7.12, allows attackers to execute arbitrary code by tricking users into opening malicious archives or visiting compromised web pages. The vulnerability enables attackers to write files outside intended directories, potentially leading to code execution with the privileges of the current user, and can be exploited to place files in sensitive locations such as the Windows Startup folder. Multiple threat groups, including GOFFEE (aka Paper Werewolf), Bitter (aka APT-C-08 or Manlinghua), and Gamaredon, have been observed exploiting CVE-2025-6218 in the wild. Attacks have involved phishing emails containing malicious RAR archives, with some campaigns using the vulnerability to establish persistence and deploy trojans on targeted systems. RARLAB addressed the issue in June 2025 with the release of WinRAR 7.12, and users are urged to update to the latest version to mitigate the risk of exploitation. The vulnerability does not affect WinRAR versions for Unix or Android platforms.
Jun 29, 2026
Google Threat Intelligence Group reported broad exploitation of **CVE-2025-8088**, a critical WinRAR path traversal vulnerability that lets attackers use malicious RAR archives with Windows Alternate Data Streams to write files to arbitrary locations. In observed attacks, the flaw was commonly used to drop payloads into the Windows Startup folder so malware would execute at the next user logon, giving intruders persistence after a victim opened a crafted archive. The activity has been linked to both state-backed and financially motivated actors, including clusters associated with Russia and China, with targeting focused on military, government, and technology organizations. Exploitation began as early as July 18, 2025, and continued after RARLAB released a fix in **WinRAR 7.13** on July 30, 2025, turning the issue into an actively abused n-day vulnerability; defenders were urged to patch quickly, keep archive software updated, and rely on protections such as Safe Browsing and Gmail filtering to block weaponized files.
Jun 29, 2026
**Google Threat Intelligence Group (GTIG)** reported ongoing, widening exploitation of a high-severity WinRAR path traversal flaw, **CVE-2025-8088**, roughly six months after it was disclosed and patched by RARLAB. GTIG assessed exploitation began as early as **July 18, 2025** (including activity nearly two weeks before the vendor fix) and has expanded across a diverse set of adversaries, spanning **Russia- and China-linked espionage actors** as well as **financially motivated cybercriminals**. Reported targeting includes military, government, and technology organizations, with multiple Russia-aligned operations focusing on **Ukrainian** entities. Technical reporting indicates the vulnerability abuses **Windows Alternate Data Streams (ADS)** within crafted archives to perform directory traversal and write files to arbitrary locations, including the Windows **Startup** folder for persistence. GTIG and other researchers describe exploit chains where a user opens a benign decoy (e.g., a PDF) while hidden ADS entries extract and drop executable content such as `LNK`, `HTA`, `BAT`, `CMD`, or script files that run at login; observed payloads include **remote access trojans, infostealers**, and malware frameworks used by named state actors (e.g., **RomCom/UNC4895**, **APT44**, **TEMP.Armageddon**, **Turla**) in addition to broader criminal activity across multiple regions.
Jun 29, 2026