WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine
Summary: Trend Micro attributed two Russia-aligned campaigns, Earth Dahu (Gamaredon) and SHADOW-EARTH-066 (UAC-0226), to continued exploitation of CVE-2025-8088, a WinRAR path traversal flaw using NTFS Alternate Data Streams that WinRAR patched in July 2025. SHADOW-EARTH-066 used crafted RAR archives with a decoy PDF and three hidden ADS payloads to deliver an updated GIFTEDCROOK stealer via a Startup-folder LNK and PowerShell loader, while Earth Dahu used an HTA-to-VBScript chain delivering GammaPhish, GammaLoad and GammaSteel, with RAR timestamps showing activity through at least April 10, 2026.
Key Takeaway: Both campaigns kept working through a flaw patched in July 2025, and Trend Micro notes WinRAR is deeply embedded in daily operations across Ukrainian organizations - the same unmanaged install base exists in most enterprises.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-8088
- Related
- CVE-2025-8088: RARLAB WinRAR Path Traversal Vulnerability Known Exploited Vulnerabilities · Aug 12, 2025