At least two Russia-aligned threat clusters are actively exploiting a high-severity WinRAR vulnerability in email-based attacks against military and government-related organizations in Ukraine.
The flaw, tracked as CVE-2025-8088, was patched in WinRAR 7.13 in July 2025. However, researchers at Trend Micro report that threat actors are still using it nearly a year later, proving once again that patched vulnerabilities can remain highly valuable when organizations struggle to identify and update exposed software.
The campaigns are attributed to two separate Russia-aligned groups: Shadow-Earth-066, also tracked by CERT-UA as UAC-0226, and Earth Dahu, better known as Gamaredon or UAC-0010.
Both groups use malicious email attachments to exploit the same WinRAR flaw, but their attack chains and final payloads differ.
Why CVE-2025-8088 Still Matters
CVE-2025-8088 is a path traversal vulnerability affecting the Windows version of WinRAR.
The flaw allows attackers to craft malicious archive files that write files outside the intended extraction directory. In practical terms, this means an attacker can place malicious files into sensitive Windows locations, including Startup folders.
Once the victim logs in or restarts the system, Windows can execute the planted file automatically.
That makes the vulnerability useful for initial access and persistence.
Even though the flaw has been patched, it remains attractive because WinRAR is widely used and often falls outside standard enterprise patching channels.
Unlike many Microsoft products, WinRAR does not automatically update through WSUS, SCCM, Intune, or Group Policy by default. Many organizations may not even have a complete inventory of where WinRAR is installed.
That creates a long tail of exposure.
Why WinRAR Is an Attractive Target
WinRAR is deeply embedded in everyday workflows across many organizations.
Users regularly open compressed files received by email, shared through portals, or downloaded from trusted-looking sources. In military and government environments, archives are often used to package documents, reports, forms, spreadsheets, and operational material.
That makes archive-based phishing highly effective.
Attackers know that users are more likely to open a RAR file if it appears connected to:
- military administration
- government requests
- operational documents
- tax or legal material
- official correspondence
- procurement
- logistics
- personnel matters
For threat actors targeting Ukraine, WinRAR offers a practical entry point into environments where compressed attachments are part of normal business operations.
Shadow-Earth-066 Deploys GiftedCrook Stealer
One campaign attributed to Shadow-Earth-066 used CVE-2025-8088 to deploy an updated version of GiftedCrook, an information stealer.
The group sent emails using military or government-related lures relevant to Ukrainian targets. The emails included malicious RAR archives crafted to exploit the WinRAR path traversal flaw.
The exploit allowed attackers to place a malicious shortcut or payload in the Windows Startup location, including via NTFS Alternate Data Streams.
Once executed, GiftedCrook collected sensitive information from the compromised system.
Its targets included:
- browser passwords
- session cookies
- documents
- files matching dozens of extensions
- other locally stored sensitive data
After completing its theft activity, the malware deleted itself from the compromised system, reducing the amount of evidence left behind.
This campaign appears designed for rapid data theft.
Earth Dahu Uses HTA-Based Espionage Chain
A separate campaign attributed to Earth Dahu, also known as Gamaredon, used the same WinRAR vulnerability but followed a different infection path.
Earth Dahu sent spear-phishing emails from compromised government accounts. These emails included weaponized archives containing documents designed to appear legitimate.
The WinRAR flaw was used to place malicious HTML Application files, or HTAs, into locations where Windows would eventually execute them.
The HTA files then downloaded a VBScript from the group’s command-and-control infrastructure hosted on Cloudflare Workers. That script loaded additional malware modules used for persistent cyber espionage.
Unlike the Shadow-Earth-066 campaign, which focused on fast credential and document theft, Earth Dahu’s activity appears more focused on persistence, surveillance, and long-term intelligence collection.
Similar Targets, Different Tactics
Although the two groups used different payloads and infection chains, their victimology was similar.
Targets included Ukrainian organizations such as:
- military innovation centers
- military formations
- law enforcement agencies
- government entities
- related public-sector organizations
This reflects the continued use of cyber operations as part of the broader Russia-Ukraine conflict.
Email remains a preferred delivery mechanism because it allows attackers to directly target individuals and organizations with tailored lures.
🇷🇺 Other Russia-Aligned Groups Also Exploited the Flaw
Trend Micro’s findings add to earlier reports that CVE-2025-8088 has been used by other Russia-aligned threat actors.
Google’s Threat Intelligence Group previously reported exploitation by groups including:
- Sandworm
- Turla
- Void Rabisu
This shows that CVE-2025-8088 is not isolated to one group or one campaign.
Once a vulnerability becomes reliable, low-cost, and easy to weaponize, multiple actors can adopt it quickly. In this case, the ability to place files into Windows Startup locations makes the flaw useful across a variety of attack chains.
Why Attackers Keep Using Old Vulnerabilities
Threat actors do not need the newest zero-day if an older vulnerability still works.
CVE-2025-8088 remains useful because:
- WinRAR has a huge install base
- many endpoints may still run vulnerable versions
- archive files are common in email workflows
- exploitation is inexpensive
- attack chains are simple
- users are accustomed to opening compressed files
- patch visibility is poor
- enterprise tools may not track WinRAR reliably
In many environments, third-party applications are harder to patch than operating systems.
That gives attackers a practical advantage.
The Patching Challenge
The main defensive challenge is visibility.
Organizations may not know where WinRAR is installed, what version is running, or whether vulnerable copies exist on unmanaged endpoints.
WinRAR also lacks some of the centralized management features enterprises rely on for patching Microsoft software.
This means defenders may need third-party inventory tools, endpoint management platforms, vulnerability scanners, or manual audits to verify exposure.
The first question should be: where is WinRAR installed?
The second question should be: is it still needed?
If WinRAR is not required, removing it may be safer than trying to manage it indefinitely.
What Defenders Should Monitor
Because both campaigns use the same persistence concept, defenders can monitor for common behaviors even if the payloads differ.
Important detection opportunities include:
- files unexpectedly written to Windows Startup folders
- LNK files created from archive extraction paths
- HTA files appearing in user-writable or Startup locations
- archive extraction followed by suspicious process execution
- suspicious use of NTFS Alternate Data Streams
- execution of
mshta.exe - downloads from Cloudflare Workers after opening archives
- suspicious VBScript execution
- browser credential access
- theft of cookies or saved passwords
- self-deleting executables
- unusual activity after RAR archive extraction
Monitoring Startup folder writes is especially important because these campaigns rely on that path for execution.
Defensive Recommendations
Organizations should take a layered approach to reducing risk from CVE-2025-8088 and similar archive-based attacks.
Recommended actions include:
- update WinRAR to the latest version
- verify WinRAR version across all endpoints
- remove WinRAR where it is not required
- block or quarantine suspicious archive attachments
- detonate inbound archives in a sandbox
- monitor for writes to Windows Startup folders
- alert on unexpected HTA, LNK, or script files created by archive tools
- restrict execution of
mshta.exewhere possible - inspect email attachments using advanced threat protection
- educate users about weaponized archives
- monitor for browser credential theft behavior
- enforce least privilege on endpoints
- review compromised government or partner sender accounts carefully
For high-risk sectors, inbound archive handling should be treated as a priority control.
Why Email Remains Central to These Attacks
Despite the growth of cloud, messaging platforms, and collaboration tools, email remains one of the most reliable ways to deliver malware.
Attackers can tailor messages to the victim’s role, organization, and current events. In Ukraine-focused campaigns, military and government-themed lures are particularly effective because they match real operational communication.
When combined with a widely installed tool such as WinRAR, a malicious archive can look routine enough to open.
This is why secure email gateways, attachment detonation, user education, and endpoint monitoring must work together.
Lessons for Organizations Outside Ukraine
Although these campaigns target Ukrainian military and government-related organizations, the lessons apply globally.
Any organization using outdated third-party software is exposed to similar attack chains.
The broader takeaway is simple: attackers prefer vulnerabilities that are cheap, reliable, and still present in real environments.
A flaw patched months ago can remain dangerous if:
- software inventory is incomplete
- patching is manual
- third-party apps are unmanaged
- users receive archive attachments
- email security is weak
- endpoint controls are limited
Organizations should not treat “patched by the vendor” as the same thing as “fixed in the environment.”
Final Thoughts
The continued exploitation of CVE-2025-8088 shows that old vulnerabilities can remain operationally valuable long after patches are released.
Russia-aligned groups are using the WinRAR flaw in separate campaigns against Ukrainian military and government organizations, delivering both fast-moving stealers such as GiftedCrook and espionage-focused malware chains involving HTA and VBScript.
The vulnerability is not new. The patch is not new. But the risk remains because vulnerable software is still present on real systems.
For defenders, the lesson is clear: know where third-party applications are installed, patch or remove them, monitor Startup folder abuse, and treat inbound archives as a serious threat vector.
The door has been open for nearly a year. The priority now is finding every system where it is still open.
