Tag: winrar

9 Attack Reports | 0 Vulnerabilities

Attack reports

Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in Southeast Asia

A Chinese threat actor, Amaranth-Dragon, has been conducting highly targeted cyber-espionage campaigns against government and law enforcement agencies in Southeast Asia throughout 2025. The group swiftly exploited the CVE-2025-8088 vulnerability in WinRAR to deliver malicious payloads, including a …
espionage
government
winrar
southeast asia
CVE-2025-8088
2026-02-04
amaranth loader
apt-41
havoc c2
havoc c2 framework
telegram rat
tgamaranth rat
Published: February 4, 2026
Linked vulnerabilities : CVE-2025-8088
Downloadable IOCs: 55

Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088

CVE-2025-8088 is a high-severity path traversal vulnerability in WinRAR that attackers exploit by leveraging Alternate Data Streams (ADS). Adversaries can craft malicious RAR archives which, when opened by a vulnerable version of WinRAR, can write files to arbitrary locations on the system. Exploit…
phishing
russia
winrar
2026-01-29
nestpacker
stockstay
unc4895
windows startup
Published: January 29, 2026
Linked vulnerabilities : CVE-2023-38831, CVE-2025-8088, CVE-2025-55182 (CVSS 10.0)
Downloadable IOCs: 44

Earth Entries alive and kicking

Earth Estries, a China-nexus APT actor, has launched a new campaign exploiting a recent WinRAR vulnerability. The attack chain involves multiple stages, including the use of encrypted stubs, hijacked DLLs, and fake PDFs with ADS streams. The group, known for using implants like Snappybee and Shadow…
shadowpad
winrar
snappybee
CVE-2025-8088
2025-10-28
Published: October 28, 2025
Linked vulnerabilities : CVE-2025-8088
Downloadable IOCs: 10

From infostealer to full RAT: dissecting the PureRAT attack chain

An investigation into what appeared at first glance to be a “standard” Python-based infostealer campaign took an interesting turn when it was discovered to culminate in the deployment of a full-featured, commercially available remote access trojan (RAT) known as PureRAT.
python
infostealer
purecrypter
service
purelogs
telegram
winrar
zip archive
purerat
pxa stealer
2025-10-10
lonenone
cryptoloader
netloader
pythonloader
Published: October 10, 2025
Downloadable IOCs: 7

WinRAR Directory Traversal & NTFS ADS Vulnerabilities (CVE-2025-6218 & CVE-2025-8088)

Two high-severity vulnerabilities in WinRAR for Windows enable attackers to write files outside intended extraction directories. CVE-2025-6218 involves traditional path traversal, while CVE-2025-8088 extends the attack using NTFS Alternate Data Streams. Both flaws allow for reliable persistence and…
zero-day
remote code execution
winrar
CVE-2025-8088
CVE-2025-6218
2025-08-25
Published: August 25, 2025
Linked vulnerabilities : CVE-2025-8088, CVE-2025-6218
Downloadable IOCs: 4

Paper Werewolf targets Russia with WinRAR zero-day vulnerability

A series of attacks by the Paper Werewolf (GOFFEE) cluster exploited vulnerabilities in WinRAR, including CVE-2025-6218 and a zero-day flaw. The threat actor used phishing emails impersonating Russian organizations, delivering malware through archive files. The attacks targeted Russian entities, ut…
phishing
zero-day
shellcode
c2
winrar
directory traversal
2025-08-20
rar
CVE-2025-6218
xpsrchvw74.exe
winrunapp.exe
Published: August 20, 2025
Downloadable IOCs: 0

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability

A zero-day vulnerability in WinRAR, CVE-2025-8088, has been discovered being exploited in the wild by the Russia-aligned group RomCom. The vulnerability allows attackers to hide malicious files in archives, which are silently deployed when extracted. The exploit was used in spearphishing campaigns …
backdoor
exploit
spearphishing
vulnerability
zero-day
mythic
winrar
snipbot
rustyclaw
russia-aligned
2025-08-11
CVE-2025-8088
Published: August 11, 2025
Linked vulnerabilities : CVE-2023-36884, CVE-2025-8088
Downloadable IOCs: 9

"Breach Report" from UAC-0099 (CERT-UA#12463)

The Ukrainian CERT-UA investigated cyberattacks by UAC-0099 against government organizations during November-December 2024. The attacks involved emails with malicious attachments, including exploits for CVE-2023-38831. The LONEPAGE program, used for command execution, has evolved to use encrypted f…
powershell
CVE-2023-38831
cloudflare
winrar
lnk files
2024-12-18
lonepage program
Published: December 18, 2024
Downloadable IOCs: 25

Earth Preta Evolves its Attacks with New Malware and Strategies

Trend Micros discusses analysis of Earth Preta’s enhancements in their attacks by introducing new tools, malware variants and strategies to their worm-based attacks and their time-sensitive spear-phishing campaign.
malware
plugx
persistence
execution
find
2024-09-10
winrar
earth preta
pubload
trojanspy
indonesia
hiupan
pullbait
fdmtp c
plugx c
pubload c
preta
fdmtp
Published: September 10, 2024
Downloadable IOCs: 41
Click here to see more Attack Reports