Serious WinRAR flaw is still being exploited. State-backed hackers and cybercriminals are attacking

Security researchers warn of the ongoing exploitation of a serious vulnerability in the popular archiving tool WinRAR. Although the bug was fixed in the summer of 2025, attackers continue to actively use it across the full spectrum of threats – from state-sponsored groups to purely financially motivated cybercriminals.

According to analysts at the Google Threat Intelligence Group (GTIG), the vulnerability CVE-2025-8088 is still being exploited in real-world attacks and serves as an entry point for malware deployment and long-term persistence on compromised systems.

How the flaw works

The CVE-2025-8088 vulnerability is a path traversal flaw and allows an attacker, using a specially crafted RAR archive, to write files outside the intended location. In practice the flaw is abused to place malicious files directly into the Windows Startup folder, which runs automatically when the user logs in.

Typical attack scenario:

• the victim opens a malicious archive in a vulnerable version of WinRAR,
• a hidden payload (e.g., LNK, BAT, or a script) is extracted outside the target folder,
• after a restart or login, the malicious code is automatically executed.

Attacks often also use the Alternate Data Streams (ADS) technique to hide malicious files inside the archive.

Patch exists, attacks continue

The vulnerability was fixed in version WinRAR 7.13, released on 30 July 2025. Its severity reaches a score of 8.8 (CVSS v3.1), or 8.4 (CVSS v4.0), which places it among highly severe security flaws.

Despite the available fix, Google confirms that even months after its release a significant portion of systems remain unpatched and vulnerable.

Zero-day and initial attacks

The vulnerability was discovered and reported by ESET, which also confirmed that it was being exploited as a zero-day from 18 July 2025, that is, before the patch was released.

Among the initial actors exploiting the flaw was the group RomCom (also known as UNC4895 or CIGAR). It combined espionage and financial motives and delivered malware from the SnipBot (NESTPACKER) family.

State and criminal groups joined in

After the vulnerability became public, its exploitation quickly spread. According to GTIG, it was used in campaigns by, among others:

• Russian state-sponsored groups Sandworm (APT44), Gamaredon, and Turla,
• an actor linked to China that used the flaw to deploy the Poison Ivy malware,
• financially motivated groups spreading common RAT tools and information stealers such as AsyncRAT or XWorm.

In some cases backdoors controlled via Telegram bots were also observed.

Exploits as commodities

One reason for the widespread attacks is the commercialization of exploits. Working WinRAR exploits were offered on underground forums for thousands of dollars. One vendor, operating under the nickname zeroplayer, offered a ready-made exploit even before the vulnerability was publicly disclosed.

This trend further lowers the technical barrier to entry and allows less sophisticated attackers to leverage advanced vulnerabilities.

This is not WinRAR's only problem

Security researchers also warn that another vulnerability, CVE-2025-6218 (CVSS 7.8), is likewise actively being exploited by multiple groups. This again confirms that N-day vulnerabilities pose a long-term risk even long after a patch is released.

What to take away from this

• WinRAR is among commonly used tools that are often underestimated in security policies
• Unpatched software remains an attractive target even months after patches are released
• Attackers today combine state, criminal, and commercial motives

If you use WinRAR, verify that you have version 7.13 or newer installed. In corporate and institutional environments this is another reminder that even seemingly "banal" applications can represent a serious security risk.