Nation-State Hackers, Cybercriminals Weaponize Patched WinRAR Flaw Despite Six-Month-Old Fix

Google Threat Intelligence observed widespread exploitation of a critical WinRAR path traversal vulnerability (CVE-2025-8088) enabling attackers to use Alternate Data Streams and directory traversal to write malicious payloads (LNK, HTA, BAT, CMD, etc.) into Windows Startup folders for persistent execution. Multiple Russian and Chinese state-linked groups (UNC4895/RomCom, FROZENBARENTS/APT44, TURla, CARPATHIAN/TEMP.Armageddon) and financially motivated actors leveraged the flaw to deliver backdoors and commodity RATs across geopolitical and commercial targets; exploitation continued months after patch availability and IOCs were published to aid hunting.