Gamaredon Phishing Campaign Exploits WinRAR Vulnerability to Target Government Agencies

According to GBHackers News, Gamaredon, also tracked as Primitive Bear and Shuckworm, has orchestrated a sophisticated phishing campaign aimed at government entities by exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR. The attackers deliver weaponised RAR archives that silently deploy HTA malware when the archive is opened, with victims prompted to view a seemingly benign PDF document contained within the archive.

By exploiting CVE-2025-8088, threat actors can craft malicious RAR archives that bypass standard security measures and drop the HTA files directly into the Windows Startup folder, enabling persistence after reboot. The vulnerability allows attackers to write files to arbitrary locations on the victim’s system, facilitating code execution through extraction alone and creating a foothold in targeted networks without immediate suspicion.

The campaign highlights a shift in Gamaredon’s tactics, combining social engineering with technical exploitation to compromise high-value government and critical infrastructure targets, with three distinct HTA samples identified as part of the operation.