10 Days to Exploit: Amaranth-Dragon Weaponizes WinRAR Flaw to Spy on SE Asia

A Check Point Research report details a fast-moving Amaranth-Dragon espionage campaign that weaponized the WinRAR vulnerability CVE-2025-8088 within ten days of disclosure to deliver malicious RAR archives to government and law enforcement targets in Southeast Asia; the attackers used the vulnerability to drop startup scripts for persistence, deployed an Amaranth loader to fetch encrypted Havoc C2 payloads, and operated a Telegram-based RAT (TGAmaranth) to exfiltrate PII and issue remote commands while restricting C2 responses to targeted-country IPs to minimize detection.