Tag: CVE-2025-8088

6 Attack Reports | 0 Vulnerabilities

Attack reports

Obfuscation Without Effort: Breaking a GIFTEDCROOK Stealer

A fresh GIFTEDCROOK stealer variant was identified as part of a UAC-0226 campaign targeting Ukraine. Initial access leverages CVE-2025-6218 and CVE-2025-8088 through a weaponized RAR archive containing a decoy PDF themed around military registry information. The attack chain uses an LNK file to exe…
stealer
data exfiltration
rc4 encryption
giftedcrook
CVE-2025-8088
CVE-2025-6218
2026-04-13
phishing campaign
powershell payload
ukraine targeting
winrar exploitation
Published: April 13, 2026
Linked vulnerabilities : CVE-2025-8088, CVE-2025-6218
Downloadable IOCs: 4

Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in Southeast Asia

A Chinese threat actor, Amaranth-Dragon, has been conducting highly targeted cyber-espionage campaigns against government and law enforcement agencies in Southeast Asia throughout 2025. The group swiftly exploited the CVE-2025-8088 vulnerability in WinRAR to deliver malicious payloads, including a …
espionage
government
winrar
southeast asia
CVE-2025-8088
2026-02-04
amaranth loader
apt-41
havoc c2
havoc c2 framework
telegram rat
tgamaranth rat
Published: February 4, 2026
Linked vulnerabilities : CVE-2025-8088
Downloadable IOCs: 55

Earth Entries alive and kicking

Earth Estries, a China-nexus APT actor, has launched a new campaign exploiting a recent WinRAR vulnerability. The attack chain involves multiple stages, including the use of encrypted stubs, hijacked DLLs, and fake PDFs with ADS streams. The group, known for using implants like Snappybee and Shadow…
shadowpad
winrar
snappybee
CVE-2025-8088
2025-10-28
Published: October 28, 2025
Linked vulnerabilities : CVE-2025-8088
Downloadable IOCs: 10

August Vulnerabilities of Note

In August 2025, eighteen high-impact vulnerabilities were identified for prioritized remediation, down from 22 in July. The month saw a focus on Citrix and D-Link flaws, with active exploitation of Citrix NetScaler products and D-Link routers. OS Command Injection was the most common weakness. One …
vulnerability
command injection
exploitation
remote code execution
snipbot
rustyclaw
patch management
deserialization
CVE-2025-8088
CVE-2025-25256
CVE-2025-8875
CVE-2025-8876
CVE-2025-20265
CVE-2025-7775
2025-09-15
mythic c2 agent
Published: September 15, 2025
Linked vulnerabilities : CVE-2024-8068, CVE-2024-8069 (CVSS 8.8), CVE-2025-54948 (CVSS 9.4), CVE-2025-8088, CVE-2024-26009 (CVSS 8.1), CVE-2025-25256 (CVSS 9.8), CVE-2025-8875 (CVSS 9.4), CVE-2025-8876 (CVSS 9.4), CVE-2025-20265 (CVSS 10.0), CVE-2025-43300 (CVSS 8.8), CVE-2025-7775 (CVSS 9.2), CVE-2025-7776 (CVSS 8.8), CVE-2025-8424 (CVSS 8.7), CVE-2025-57819, CVE-2007-0671, CVE-2013-3893, CVE-2020-25079, CVE-2020-25078, CVE-2025-48384, CVE-2022-40799
Downloadable IOCs: 11

WinRAR Directory Traversal & NTFS ADS Vulnerabilities (CVE-2025-6218 & CVE-2025-8088)

Two high-severity vulnerabilities in WinRAR for Windows enable attackers to write files outside intended extraction directories. CVE-2025-6218 involves traditional path traversal, while CVE-2025-8088 extends the attack using NTFS Alternate Data Streams. Both flaws allow for reliable persistence and…
zero-day
remote code execution
winrar
CVE-2025-8088
CVE-2025-6218
2025-08-25
Published: August 25, 2025
Linked vulnerabilities : CVE-2025-8088, CVE-2025-6218
Downloadable IOCs: 4

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability

A zero-day vulnerability in WinRAR, CVE-2025-8088, has been discovered being exploited in the wild by the Russia-aligned group RomCom. The vulnerability allows attackers to hide malicious files in archives, which are silently deployed when extracted. The exploit was used in spearphishing campaigns …
backdoor
exploit
spearphishing
vulnerability
zero-day
mythic
winrar
snipbot
rustyclaw
russia-aligned
2025-08-11
CVE-2025-8088
Published: August 11, 2025
Linked vulnerabilities : CVE-2023-36884, CVE-2025-8088
Downloadable IOCs: 9
Click here to see more Attack Reports