WinRAR Vulnerability Exploited by APT-C-08 to Target Government Agencies

The article reports that APT-C-08, also known as BITTER, has weaponised a critical WinRAR directory traversal vulnerability, CVE-2025-6218, to target government organisations across South Asia. Security researchers observed exploitation of WinRAR versions 7.11 and earlier, beginning with a weaponised RAR archive named “Provision of Information for Sectoral for AJK[.]rar” (MD5: f6f2fdc38cd61d8d9e8cd35244585967) that is 51.4 KB in size.

The exploit relies on improper path normalisation during extraction, with attackers crafting paths containing spaces after dot-dot notation to bypass checks and enable directory traversal, including attempts to reach the AppData\Roaming\Microsoft/Templates\Normal[.]dotm location.

The macro-enabled template Normal[.]dotm in that location automatically loads when Word documents are opened, providing persistent code execution and triggering a winnsc.exe downloader that gathers system details and reports to a command-and-control server at teamlogin.esanojinjasvc[.]com. A second variant used the 596 KB archive “Weekly AI Article[.]rar” to deploy another Normal[.]dotm and similar payloads, extending the attack chain against compromised systems.