Russian Hackers Exploit WinRAR Zero-Day to Spread RomCom Malware
TL;DR
Russia-linked attackers exploited a high-severity WinRAR vulnerability (CVE-2025-8088) before it was patched, using targeted spearphishing campaigns against European and Canadian companies. The vulnerability involves a path-traversal flaw that was exploited via malicious archives containing ADSes, leading to malware deployment and backdoors like Mythic, SnipBot, and RustyClaw. Multiple threat groups, including RomCom and Paper Werewolf, have used this zero-day in targeted attacks, highlighting the importance of timely updates and vigilance.
- Russia's RomCom among those exploiting a WinRAR 0-day in highly-targeted attacks theregister.com
- Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability WeLiveSecurity
- WinRAR zero-day exploited to plant malware on archive extraction BleepingComputer
- Russian Hackers Exploited WinRAR Zero-Day in Attacks on Europe, Canada SecurityWeek
- WinRAR Zero-Day CVE-2025-8088 Exploited to Spread RomCom Malware Hack Read
Want the full story? Read the original reporting
Read on theregister.com