Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

WinRAR Flaw CVE-2025-8088 Hits Ukrainian Firms Despite Patch

Part of the CVE-2025-8088 story · since 28 Jan

Quiet for 2 weekslast report 16 Oct22 articles9 outlets
28 Jan · SecurityWeek first16 Jun2 Aug18 SepNowThis article18th of 22
  • Wed 28 Jan, 09:45 UTC. SecurityWeek, first report. APTs, Cybercriminals Widely Exploiting WinRAR Vulnerability. Cites a CVE in CISA KEV.
  • Wed 28 Jan, 10:50 UTC. The Hacker News, its first report on the story. Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088. Cites a CVE in CISA KEV.
  • Wed 28 Jan, 23:36 UTC. Dark Reading, its first report on the story. Months After Patch, WinRAR Bug Poised to Hit SMBs Hardest. Cites a CVE in CISA KEV.
  • Thu 29 Jan, 02:55 UTC. SecurityOnline, its first report on the story. The “Zeroplayer” Arsenal: WinRAR Flaw CVE-2025-8088 Weaponized by Spies. Cites a CVE in CISA KEV.
  • Thu 29 Jan, 11:40 UTC. Security Affairs, its first report on the story. Nation-state and criminal actors leverage WinRAR flaw in attacks. Cites a CVE in CISA KEV.
  • Wed 4 Feb, 14:05 UTC. Check Point, its first report on the story. Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia. Cites a CVE in CISA KEV.
  • Wed 4 Feb, 15:10 UTC. The Hacker News. China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns. Cites a CVE in CISA KEV.
  • Thu 5 Feb, 03:26 UTC. SecurityOnline. 10 Days to Exploit: Amaranth-Dragon Weaponizes WinRAR Flaw to Spy on SE Asia. Cites a CVE in CISA KEV.
  • Thu 5 Feb, 10:50 UTC. Security Affairs. China-linked Amaranth-Dragon hackers target Southeast Asian governments in 2025. Cites a CVE in CISA KEV.
  • Sun 8 Feb, 14:25 UTC. Security Affairs. SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 83. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 16:01 UTC. Google Cloud, its first report on the story. Google: WinRAR CVE-2025-8088 abused by state actors to persist. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:32 UTC. The Hacker News. Kali Linux integrates Anthropic Claude AI to speed cyber attacks. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 10:27 UTC. Securelist, its first report on the story. Q4 2025 Exploits Hit Windows and Linux, Spotlight CVE-2025-55182. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 11:21 UTC. Infosecurity, its first report on the story. Ukrainian networks hit by stealth Gamaredon worm via WinRAR flaw. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 11:41 UTC. Security Affairs. Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian Targets. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 16:10 UTC. Dark Reading. Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 14:51 UTC. Security Affairs. Russian APTs exploit WinRAR flaw CVE-2025-8088 to target Ukraine. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:08 UTC. SecurityOnline. WinRAR Flaw CVE-2025-8088 Hits Ukrainian Firms Despite Patch. Cites a CVE in CISA KEV. This article, 18th of 22.
  • Tue 30 Jun, 08:21 UTC. SecurityOnline. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 16:27 UTC. The Hacker News. Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 20:01 UTC. Security Affairs. Kazakhstan Based Espionage Group Exploits CVE to Target Energy and Government. Cites a CVE in CISA KEV.
  • Fri 16 Oct, 09:08 UTC. SecurityOnline. Espionage Group Exploits WinRAR Flaw to Target CIS Governments. Cites a CVE in CISA KEV.

The content focuses on the ongoing exploitation of the WinRAR vulnerability CVE-2025-8088, targeting Ukrainian organizations despite a patch being released in 2025. Attackers use NTFS Alternate Data Streams to deliver malicious payloads through RAR files disguised as decoy documents. The document highlights two threat actor groups: SHADOW-EARTH-066, which has evolved its methods to include memory-resident malware targeting multiple browsers, and Earth Dahu, which employs scripts for its attacks.

The article emphasizes the issue of patch adoption, as WinRAR does not auto-update and is often overlooked in standard vulnerability management, stressing the need for organizations to audit and monitor their installations to mitigate risks.

How the story developed

All 22 articles
Quiet for 2 weekslast report 16 Oct22 articles9 outlets

22 articles from 9 outlets since 28 Jan. Quiet since 16 Oct. This was the 18th report, 138 days after the first.

Now28 Jan1625530 May1423213 OctFirst reportSecurityWeek · 28 Jan, 09:45This article18th of 22 · day 138
  • Wed 28 Jan, 09:45 UTC. SecurityWeek, first report. APTs, Cybercriminals Widely Exploiting WinRAR Vulnerability. Cites a CVE in CISA KEV.
  • Wed 28 Jan, 10:50 UTC. The Hacker News, its first report on the story. Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088. Cites a CVE in CISA KEV.
  • Wed 28 Jan, 23:36 UTC. Dark Reading, its first report on the story. Months After Patch, WinRAR Bug Poised to Hit SMBs Hardest. Cites a CVE in CISA KEV.
  • Thu 29 Jan, 02:55 UTC. SecurityOnline, its first report on the story. The “Zeroplayer” Arsenal: WinRAR Flaw CVE-2025-8088 Weaponized by Spies. Cites a CVE in CISA KEV.
  • Thu 29 Jan, 11:40 UTC. Security Affairs, its first report on the story. Nation-state and criminal actors leverage WinRAR flaw in attacks. Cites a CVE in CISA KEV.
  • Wed 4 Feb, 14:05 UTC. Check Point, its first report on the story. Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia. Cites a CVE in CISA KEV.
  • Wed 4 Feb, 15:10 UTC. The Hacker News. China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns. Cites a CVE in CISA KEV.
  • Thu 5 Feb, 03:26 UTC. SecurityOnline. 10 Days to Exploit: Amaranth-Dragon Weaponizes WinRAR Flaw to Spy on SE Asia. Cites a CVE in CISA KEV.
  • Thu 5 Feb, 10:50 UTC. Security Affairs. China-linked Amaranth-Dragon hackers target Southeast Asian governments in 2025. Cites a CVE in CISA KEV.
  • Sun 8 Feb, 14:25 UTC. Security Affairs. SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 83. Cites a CVE in CISA KEV.
  • Wed 25 Feb, 16:01 UTC. Google Cloud, its first report on the story. Google: WinRAR CVE-2025-8088 abused by state actors to persist. Cites a CVE in CISA KEV.
  • Thu 26 Feb, 16:32 UTC. The Hacker News. Kali Linux integrates Anthropic Claude AI to speed cyber attacks. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 10:27 UTC. Securelist, its first report on the story. Q4 2025 Exploits Hit Windows and Linux, Spotlight CVE-2025-55182. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 11:21 UTC. Infosecurity, its first report on the story. Ukrainian networks hit by stealth Gamaredon worm via WinRAR flaw. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 11:41 UTC. Security Affairs. Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian Targets. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 16:10 UTC. Dark Reading. Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 14:51 UTC. Security Affairs. Russian APTs exploit WinRAR flaw CVE-2025-8088 to target Ukraine. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:08 UTC. SecurityOnline. WinRAR Flaw CVE-2025-8088 Hits Ukrainian Firms Despite Patch. Cites a CVE in CISA KEV. This article, 18th of 22.
  • Tue 30 Jun, 08:21 UTC. SecurityOnline. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 16:27 UTC. The Hacker News. Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 20:01 UTC. Security Affairs. Kazakhstan Based Espionage Group Exploits CVE to Target Energy and Government. Cites a CVE in CISA KEV.
  • Fri 16 Oct, 09:08 UTC. SecurityOnline. Espionage Group Exploits WinRAR Flaw to Target CIS Governments. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 22 articles as a list
  1. Wed 28 JanDay 03
    1. APTs, Cybercriminals Widely Exploiting WinRAR Vulnerability09:45 · SecurityWeek · First report · Exploited CVE · Known exploited CVE
    2. Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-808810:50 · The Hacker News · Known exploited CVE
    3. Months After Patch, WinRAR Bug Poised to Hit SMBs Hardest23:36 · Dark Reading · Known exploited CVE
  2. Thu 29 JanDay 12
    1. The “Zeroplayer” Arsenal: WinRAR Flaw CVE-2025-8088 Weaponized by Spies02:55 · SecurityOnline · Known exploited CVE
    2. Nation-state and criminal actors leverage WinRAR flaw in attacks11:40 · Security Affairs · Known exploited CVE

  3. Quiet for 6 days

    Wed 4 FebDay 72
    1. Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia14:05 · Check Point · Picked up again · Known exploited CVE
    2. China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns15:10 · The Hacker News · Known exploited CVE
  4. Thu 5 FebDay 82
    1. 10 Days to Exploit: Amaranth-Dragon Weaponizes WinRAR Flaw to Spy on SE Asia03:26 · SecurityOnline · Known exploited CVE
    2. China-linked Amaranth-Dragon hackers target Southeast Asian governments in 202510:50 · Security Affairs · Known exploited CVE

  5. Quiet for 3 days

    Sun 8 FebDay 111
    1. SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 8314:25 · Security Affairs · Picked up again · Known exploited CVE

  6. Quiet for 2 weeks

    Wed 25 FebDay 281
    1. Google: WinRAR CVE-2025-8088 abused by state actors to persist16:01 · Google Cloud · Picked up again · Known exploited CVE
  7. Thu 26 FebDay 291
    1. Kali Linux integrates Anthropic Claude AI to speed cyber attacks16:32 · The Hacker News · Known exploited CVE

  8. Quiet for 8 days

    Fri 6 MarDay 371
    1. Q4 2025 Exploits Hit Windows and Linux, Spotlight CVE-2025-5518210:27 · Securelist · Picked up again · Known exploited CVE

  9. Quiet for 12 weeks

    Mon 1 JunDay 1241
    1. Ukrainian networks hit by stealth Gamaredon worm via WinRAR flaw11:21 · Infosecurity · Picked up again · Known exploited CVE

  10. Quiet for 3 days

    Thu 4 JunDay 1271
    1. Gamaredon Uses WinRAR Vulnerability to Launch Modular Spy Campaign on Ukrainian Targets11:41 · Security Affairs · Picked up again · Known exploited CVE

  11. Quiet for 5 days

    Tue 9 JunDay 1321
    1. Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs16:10 · Dark Reading · Picked up again · Known exploited CVE
  12. Wed 10 JunDay 1331
    1. Russian APTs exploit WinRAR flaw CVE-2025-8088 to target Ukraine14:51 · Security Affairs · Known exploited CVE

  13. Quiet for 4 days

    Mon 15 JunDay 1381
    1. WinRAR Flaw CVE-2025-8088 Hits Ukrainian Firms Despite Patch02:08 · SecurityOnline · Picked up again · Known exploited CVE · This article, 18th of 22

  14. Quiet for 2 weeks

    Tue 30 JunDay 1531
    1. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits08:21 · SecurityOnline · Picked up again · Known exploited CVE

  15. Quiet for 15 weeks

    Thu 15 OctDay 2602
    1. Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments16:27 · The Hacker News · Picked up again · Known exploited CVE
    2. Kazakhstan Based Espionage Group Exploits CVE to Target Energy and Government20:01 · Security Affairs · Known exploited CVE
  16. Fri 16 OctDay 2611
    1. Espionage Group Exploits WinRAR Flaw to Target CIS Governments09:08 · SecurityOnline · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in