Tag: CVE-2025-6218

3 Attack Reports | 0 Vulnerabilities

Attack reports

Obfuscation Without Effort: Breaking a GIFTEDCROOK Stealer

A fresh GIFTEDCROOK stealer variant was identified as part of a UAC-0226 campaign targeting Ukraine. Initial access leverages CVE-2025-6218 and CVE-2025-8088 through a weaponized RAR archive containing a decoy PDF themed around military registry information. The attack chain uses an LNK file to exe…

data exfiltration

phishing campaign

powershell payload

ukraine targeting

winrar exploitation

Published: April 13, 2026

Linked vulnerabilities : CVE-2025-8088, CVE-2025-6218

Downloadable IOCs: 4

WinRAR Directory Traversal & NTFS ADS Vulnerabilities (CVE-2025-6218 & CVE-2025-8088)

Two high-severity vulnerabilities in WinRAR for Windows enable attackers to write files outside intended extraction directories. CVE-2025-6218 involves traditional path traversal, while CVE-2025-8088 extends the attack using NTFS Alternate Data Streams. Both flaws allow for reliable persistence and…

remote code execution

Published: August 25, 2025

Linked vulnerabilities : CVE-2025-8088, CVE-2025-6218

Downloadable IOCs: 4

Paper Werewolf targets Russia with WinRAR zero-day vulnerability

A series of attacks by the Paper Werewolf (GOFFEE) cluster exploited vulnerabilities in WinRAR, including CVE-2025-6218 and a zero-day flaw. The threat actor used phishing emails impersonating Russian organizations, delivering malware through archive files. The attacks targeted Russian entities, ut…

directory traversal

Published: August 20, 2025

Downloadable IOCs: 0

Click here to see more Attack Reports