Gamaredon Exploits WinRAR Path Traversal to Unleash GammaDrop Malware

HarfangLab documents an active Gamaredon spearphishing campaign (since Sept 2025 and ongoing) abusing WinRAR path traversal (CVE-2025-8088) to drop obfuscated VBS downloaders (GammaDrop → GammaLoad) that establish persistence via the Startup folder and beacon to Cloudflare-proxied C2 and fallback domains; the campaign targets Ukrainian government, military, and SSU directorates and uses fast-flux, dynamic DNS, compromised email relays, and evolving archive formats to evade detection.