A critical vulnerability, CVE-2025-8088, in WinRAR has seen widespread exploitation by a variety of threat actors, according to a report from the Google Threat Intelligence Group. This path traversal vulnerability, which was patched in July 2025, allows attackers to craft malicious RAR archives using Windows Alternate Data Streams, enabling them to write files to arbitrary system locations.
Both state-sponsored and financially motivated groups are leveraging this n-day vulnerability. Russian threat actors such as UNC4895, APT44, Temp.Armageddon, and Turla have been targeting Ukrainian military and government entities. Meanwhile, Chinese state-sponsored actors are deploying POISONIVY malware, further exacerbating the situation. Financially motivated cybercriminals are utilizing the exploit to distribute commodity Remote Access Trojans (RATs) and stealers across multiple sectors, impacting commercial organizations in Indonesia, the hospitality sector, and Brazilian banking users.
The exploit’s potential was recognized even before the patch release, with its initial sale on cybercrime forums for $80,000. Given the severe implications, it is imperative for organizations to update WinRAR to version 7.13 or later. Additionally, they should implement measures to detect any post-exploitation activities to mitigate the threat posed by these diverse attack campaigns.

Collections

A critical path traversal vulnerability (CVE-2025-8088) in WinRAR is being actively exploited by state-sponsored groups from Russia and China, as well as financially motivated cybercriminals. The flaw allows attackers to write files to arbitrary system locations through malicious RAR archives using Windows Alternate Data Streams. Russian actors are targeting Ukrainian entities, Chinese groups are deploying POISONIVY malware, and cybercriminals are distributing RATs and stealers globally. Organizations must update to WinRAR version 7.13 or later and implement post-exploitation detection measures.

Widespread Exploitation of WinRAR Vulnerability CVE-2025-8088