Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukraine

0. Overview

This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 (also tracked by CERT-UA as UAC-0226), delivering an updated variant of the GIFTEDCROOK information stealer against Ukrainian military and government entities. As documented in threat intelligence research published by Trend Micro, this campaign weaponizes a known path traversal flaw in WinRAR (CVE-2025-8088) to compromise unmanaged endpoints.

The malware is distributed via password-protected RAR archives sent through…