Warning: WinRAR Vulnerability CVE-2025-6218 Under Active Attack by Multiple Threat Groups

According to CISA, the WinRAR vulnerability CVE-2025-6218 is a path traversal flaw that could enable code execution, with exploitation requiring a user to visit a malicious page or open a malicious file. The flaw was patched by RARLAB with WinRAR 7.12 in June 2025 and only affects Windows-based builds, with versions for other platforms not affected. The U.S. Cybersecurity and Infrastructure Security Agency has noted active exploitation and has added the vulnerability to its Known Exploited Vulnerabilities catalog.

The vulnerability has been exploited by threat groups tracked as GOFFEE (aka Paper Werewolf), Bitter (aka APT-C-08 or Manlinghua), and Gamaredon, which have used it in phishing and other attacks to deliver payloads such as a C# trojan and backdoors. In some campaigns, attackers have weaponised the vulnerability to drop files into Windows Startup and enable persistence.

The C2 activity linked to the trojan uses a server named johnfashionaccess[.]com, and the operation has included use of phishing to compromise targets, including a Russian-linked group observed in Ukraine-focused campaigns.