Old WinRAR Flaw Still Fuels Attacks on Ukraine in 2026

Trend Micro analysis shows that CVE-2025-8088, a WinRAR NTFS Alternate Data Stream path-traversal flaw patched in July 2025, continues to be exploited through 2026 by Russia-aligned actors (SHADOW-EARTH-066 and Earth Dahu/Gamaredon) against Ukrainian organizations; attackers deliver RARs that drop startup-persisted payloads (memory-resident in-memory DLL loaders or HTA scripts) to steal credentials and documents and exfiltrate data, and the persistence of this threat is amplified by WinRAR's lack of auto-update and enterprise patch coverage.