At least two Russia-aligned threat clusters have exploited a high-severity WinRAR flaw that has been patched for nearly a year in email-based attacks against military and government organizations in Ukraine. The findings by Trend Micro are further evidence that the vulnerability, tracked as CVE-2025-8088, continues to be a target for threat actors.
Russia-backed threat groups tracked as Shadow-Earth-066 and Earth Dahu, aka Gamaredon, are currently targeting the flaw via separate attacks that both begin with weaponized emails but then veered off into different attack chains, according to a blog post published on Monday by Trend Micro.
In one campaign, Shadow-Earth-066 — tracked as UAC-0226 by Ukraine’s Computer Emergency Response Team (CERT-UA) — used the vulnerability to deploy an updated version of the GiftedCrook information stealer, which collects credentials and documents and then deletes itself from the compromised system.
A separate campaign by Earth Dahu — a long-time Russia-aligned threat actor also tracked as Primitive Bear, Shuckworm, Aqua Blizzard, and UAC-0010, among other names — exploited the flaw to deliver espionage-focused malware through an infection chain that uses HTML applications (HTAs).
“WinRAR is deeply embedded in daily operations across Ukrainian organizations, making it an attractive target for exploitation,” despite the flaw having been patched in WinRAR 7.13 in July 2025, Trend Micro researchers Hiroyuki Kakara and Feike Hacquebord wrote in the post.
Indeed, as recently as April, both Show-Earth-066 and Earth Dahu were still generating new exploit samples, and Earth Dahu currently remains active, according to Trend Micro. Targets were similar across both campaigns, with victimology focused on government entities such as military innovation centers, military formations, law enforcement agencies, and related organizations.
Further, Google’s Threat Intelligence Group reported that other Russia-aligned threat actors, including Sandworm, Turla, and Void Rabisu, exploited the same vulnerability earlier this year, the researchers said.
Unpatched WinRAR Systems Remain a Target
CVE-2025-8088 is a path traversal vulnerability affecting the Windows version of WinRAR that allows attackers to execute arbitrary code. Specifically, attackers who exploit the vulnerability can craft malicious archive files that write files outside the intended extraction directory, including into Windows Startup locations that enable code execution after login.
WinRAR is a popular cross-platform file extraction software used not only by many Ukrainian organizations, but also by hundreds of millions of users worldwide. Indeed, WinRAR flaws in general are popular targets for attacks due to this large install base. An earlier flaw tracked as CVE-2023-38831 also came under heavy fire in 2023 from both Russian and Chinese adversaries.
In fact, Trend Micro’s findings support earlier research demonstrating that organizations that haven’t patched CVE-2025-8088 remain extremely vulnerable to attack. A report from Google published in January found that state-sponsored actors are targeting the flaw, with small and midsized businesses especially in the cross-hairs.
Waseem Ahmed, head of engineering at Secure.com, tells Dark Reading it’s notable, but not surprising, that attackers are still investing in the flaw. That may be because it’s cheap to exploit it, as both campaigns demonstrate in their attack chains.
“There’s no exotic exploit to engineer and no infrastructure to stand up; it’s a phishing email with a booby-trapped archive, and the technique has been a market commodity since before it was even public,” he says. “The barrier to weaponize is essentially gone.”
Meanwhile, WinRAR remains unpatched on enough endpoints to make the investment in exploiting it worthwhile, the Trend Micro researchers noted. That may be because WinRAR does not auto-update, does not support Group Policy, and falls outside enterprise patch channels like WSUS, SCCM, or Intune. Thus, verifying patch status across hundreds of endpoints requires third-party tools or manual auditing, they wrote.
Similar, But Not Equal WinRAR Attacks
Indeed, both Shadow-Earth-066 and Earth Dahu use different approaches to exploit CVE-2025-8088. The former group emails targets with lures that use military or government-related topics relevant to Ukraine with a malicious RAR archive included. The archive abuses the WinRAR path traversal flaw so attackers can place a malicious shortcut (LNK) or payload in a Windows Startup location using NTFS Alternate Data Streams.
In this case, the payload that’s eventually executed is GiftedCrook, a stealer designed for rapid credential and document theft that harvests browser passwords, session cookies, and files matching 35 extensions.
Earth Dahu also uses malicious emails to exploit the flaw, but in a slightly different way. First, the actor sends a spear-phishing email from a compromised government account that includes a weaponized archive containing documents crafted to appear legitimate. Earth Dahu then uses the WinRAR flaw to place malicious HTA files into locations where Windows will eventually execute them. The HTA files downloads a VBScript from the threat group’s command-and-control infrastructure on Cloudflare Workers, which in turn loads malware modules for conducting persistent cyber espionage activities.
If You Haven’t Patched, Do It Now
Patching affected systems is the best way to avoid exploitation of the WinRAR flaw, according to Trend Micro. “Tracking and patching these applications is not optional,” the researchers wrote in the post. “It is a basic requirement for reducing the attack surface that threat actors rely on.”
However, some organizations may not have patched because they don’t know where WinRAR may be exposed in a system, Secure.com’s Ahmed observes. In this case, he suggests an organization “start from the assumption that you can’t patch what you haven’t found,” and practice continuous asset discovery and risk-based prioritization to find where a network may be vulnerable.
“Then take the controls this bug hands you for free,” he recommends. Since “every one of these campaigns persists the same way — by writing to the Windows Startup folder,” an organization should start by setting up an alert on that, Ahmed advises.
Further, defenders should “strip or detonate inbound archives at the mail gateway, and remove or allowlist WinRAR where it isn’t needed” to help thwart the attack chains. “The door’s been open for a year,” Ahmed says. “The real fix is to stop pretending you know where all your doors are.”
No responses yet