US Edition
High-Severity WinRAR 0-Day Exploited for Weeks by 2 Groups
EUROPE AND CANADA, AUG 11 – RomCom used malicious RAR archives in spearphishing campaigns to deploy backdoors and malware for espionage against European and Canadian firms, with no successful compromises reported.
- On July 18, 2025, the Russian-aligned group RomCom exploited a zero-day path traversal vulnerability, CVE-2025-8088, in WinRAR to target companies in Europe and Canada via spearphishing campaigns.
- ESET researchers discovered the vulnerability after identifying malicious RAR archives that used alternate data streams to deploy backdoors including SnipBot, RustyClaw, and Mythic agent, prompting a patch release on July 30, 2025.
- The attacks deployed malicious LNK and DLL files by placing the shortcuts within the Windows Startup folder to maintain persistence, with the malware activating specifically when the system’s domain matches a predefined target value embedded in its code.
- RomCom's phishing emails pretended to be job applications and reconnaissance confirmed high targeting, with roughly a dozen potential victims but no confirmed compromises, while another threat actor 'Paper Werewolf' also exploited the flaw.
- WinRAR lacks an auto-update feature, so users must manually install version 7.13 to mitigate the vulnerability, but public disclosure raises the risk of wider exploitation by other actors in future attacks.
Insights by Ground AI
Does this summary seem wrong?
Podcasts & Opinions
15 Articles
15 Articles
The vulnerability CVE-2025-8088 in WinRAR is actively exploited by Russian attackers of the RomCom group. Via false CV, they install malware to spy on companies in Europe and Canada.
Coverage Details
Total News Sources15
Leaning Left1Leaning Right0Center4Last UpdatedBias Distribution80% Center
Bias Distribution
- 80% of the sources are Center
80% Center
L 20%
C 80%
Factuality
To view factuality data please Upgrade to Premium
