WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine

Trend Micro and Sekoia analyses show two Russia-aligned actors (Earth Dahu/Gamaredon and SHADOW-EARTH-066) have actively exploited a patched WinRAR path traversal (CVE-2025-8088) to deliver information-stealing malware and espionage toolchains against Ukrainian organizations, using ADS-based RAR payloads, LNK/PowerShell loaders, HTA→VBScript chains, and dedicated C2 infrastructure to maintain persistent access and exfiltrate credentials and documents.