New Amaranth Dragon cyberespionage group exploits WinRAR flaw

Check Point researchers attribute a targeted espionage campaign to an actor called Amaranth Dragon (linked to APT41) that has been actively exploiting WinRAR path-traversal CVE-2025-8088 since August 2025 to drop persistent loaders and deploy post-exploitation frameworks (Havoc) and a Telegram-based RAT (TGAmaranth) against government and law-enforcement targets across Southeast Asia; the attacks use ADS-based persistence, DLL sideloading, geofenced Cloudflare-hosted C2s, and include published IOCs and YARA rules—mitigation advice is to upgrade WinRAR to 7.13+ (latest 7.20).