WinRAR path traversal flaw still exploited by numerous hackers
BleepingComputer • • technology
Key Points:
- Multiple state-sponsored and financially motivated threat actors are actively exploiting the high-severity CVE-2025-8088 vulnerability in WinRAR, which involves a path traversal flaw using Alternate Data Streams (ADS) to deliver malicious payloads.
- The vulnerability allows attackers to plant malware in arbitrary locations such as the Windows Startup folder, ensuring persistence across system reboots, with exploitation observed since at least July 18, 2025.
- Notable state-backed groups exploiting this flaw include UNC4895 (RomCom), APT44 (FROZENBARENTS), TEMP.Armageddon (CARPATHIAN), Turla (SUMMIT), and China-linked actors, targeting Ukrainian military units and deploying various malware families.
