Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088
Summary: Google's Threat Intelligence Group reported that Russian and Chinese state-linked actors and financially motivated groups are exploiting CVE-2025-8088, a WinRAR path traversal flaw (CVSS 8.8) patched in version 7.13 on July 30, 2025, to drop files into the Windows Startup folder for persistence. ESET, which found and reported the flaw, saw the RomCom group using it as a zero-day as early as July 18, 2025, to deliver SnipBot, and exploitation has since spread to AsyncRAT, XWorm, Poison Ivy, and a malicious Chrome extension targeting two Brazilian banking sites.
Key Takeaway: A flaw patched in July is still being exploited as an n-day by nation-state and criminal actors alike, and an underground supplier marketed a WinRAR exploit for thousands of dollars before public disclosure - so the window between patch release and your fleet actually updating is the window they are counting on.