Espionage and financially motivated threat actors are exploiting critical WinRAR vulnerability CVE-2025-8088.

Google Cloud Platform provides a suite of cloud computing services for building, deploying, and managing applications and infrastructure on Google's global network. Developers can learn about cloud-native development, machine learning, and big data analytics to leverage GCP's scalable and reliable cloud infrastructure for their projects.

Google Cloud

Google Threat Intelligence Group reports widespread exploitation of CVE-2025-8088, a critical path traversal vulnerability in WinRAR patched in July 2025. State-sponsored actors from Russia and China, along with financially motivated groups, are actively exploiting this n-day vulnerability to drop malicious payloads into Windows Startup folders for persistence. Russian groups like UNC4895, APT44, and Turla target Ukrainian military and government entities, while Chinese actors deploy POISONIVY malware. Financially motivated actors use the exploit to deliver commodity RATs and stealers across various sectors. The vulnerability's exploitation involves crafting malicious RAR archives using Alternate Data Streams to write files to arbitrary system locations. Organizations should immediately update WinRAR to version 7.13 or later and implement detection for post-exploitation tactics.

Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088