US EditionWinRAR Path Traversal Flaw Still Exploited by Numerous Hackers
State-sponsored and financially motivated groups exploit WinRAR CVE-2025-8088 to deploy diverse malware, with over 500 million users at risk, Google researchers report ongoing attacks.
- Tuesday's GTIG report found active exploitation of CVE-2025-8088 since August, with the flaw patched in WinRAR version 7.13 on July 30, 2025.
- Researchers say exploitation began as early as July 18, 2025, with multiple operators sourcing exploits from 'zeroplayer' while WinRAR lacks auto-update, requiring manual updates.
- Analysis shows crafted RAR archives drop LNK, HTA, BAT, CMD files via WinRAR Alternate Data Streams, delivering POISONIVY, NESTPACKER / Snipbot, STOCKSTAY, XWorm, and AsyncRAT.
- WinRAR's Windows user base exceeds 500 million, while attackers have planted malware in the Windows Startup folder with decoy files, and state-backed groups targeted Ukrainian military and government entities.
- Google urged organizations to install security updates and published IoCs, as underground forums and malware creators integrate the WinRAR flaw into tools, with exploit prices ranging from $80,000 to $300,000.
11 Articles
11 Articles
Cybercriminals and nation-state groups are exploiting a six-month old WinRAR defect
Google Threat Intelligence Group warned that a diverse and growing collection of attackers, including nation-state groups and financially motivated cybercriminals, are exploiting a path-traversal vulnerability affecting WinRAR that was disclosed and patched six months ago. The high-severity vulnerability — CVE-2025-8088 — was exploited in the wild almost two weeks before RARLAB, the vendor behind the file archiver tool, addressed the vulnerabili…
A critical vulnerability of WinRAR (CVE-2025-8088), corrected six months ago, is still massively exploited. From groups of Russian and Chinese state pirates to cyber criminals, all take advantage of the lack of automatic updates to conduct spying and data theft campaigns, according to Google.
Millions At Risk As Attackers Exploit This Alarming WinRAR Security Flaw
Remember the WinRAR path handling exploit we reported on back in August? According to Google, that same flaw, officially dubbed CVE-2025-8088, is still being actively exploited, even though versions of WinRAR newer than v7.12 have been patched. Google's recent blog post on the exploit activity provides a timeline of exploits across six different
Coverage Details
Bias Distribution
- 67% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
