Loading story…
Attackers abused the WinRAR remote code execution flaw CVE-2023-38831 in spear-phishing campaigns that used crafted RAR archives to trigger malware execution when victims opened a decoy document. In one case, a phishing email impersonating a consultant from Russia’s Ministry of Industry and Trade targeted a major Russian semiconductor supplier and delivered the Athena agent from the Mythic C2 framework. The archive paired a benign PDF with a malicious script disguised through the trailing-space filename trick tied to the WinRAR flaw; execution led to a PowerShell downloader, retrieval of a decoy PDF and payload from 45.142.212.34, persistence via a scheduled task named aimp2, and command-and-control over Discord-backed channels.
Ukraine’s CERT-UA separately reported active exploitation of the same vulnerability by UAC-0057, which used a malicious archive named Збірник_тез_НУОУ_23.rar to launch a chain involving a BAT file, an LNK shortcut, mshta.exe, and an embedded HTA file. That intrusion dropped a decoy PDF, executed JavaScript identified as a PicassoLoader variant, downloaded an SVG containing an encrypted .NET payload, decrypted it with the Rabbit algorithm, and ultimately deployed Cobalt Strike Beacon. The reports indicate that public proof-of-concept code and broad post-disclosure abuse have made CVE-2023-38831 a practical delivery vector for multiple malware families and threat actors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
In the same August 31 advisory, CERT-UA warned that CVE-2023-38831 was being actively exploited and noted that public proof-of-concept code existed for generating malicious archives. The agency also published host and network indicators tied to the campaign.
CERT-UA disclosed a cyberattack by UAC-0057 using a malicious archive named "Збірник_тез_НУОУ_23.rar" to exploit CVE-2023-38831. The infection chain used a BAT file, LNK shortcut, mshta, JavaScript, and an SVG-hosted encrypted .NET payload that ultimately deployed Cobalt Strike Beacon.
Group-IB reported DarkMe malware exploiting CVE-2023-38831 and also observed GuLoader and Remcos RAT using the same exploit path. This showed the vulnerability was being adopted by multiple malware operators.
The domains topibuzz.space and windacarmelita.pw, later tied to a CERT-UA-described exploitation campaign, were registered through publicdomainregistry.com. CERT-UA linked them to payload delivery and related network activity.
RARLAB released WinRAR 6.23 to remediate CVE-2023-38831. The fixed version addressed the code execution issue exploited through specially crafted archives.
Artifacts later published by CERT-UA show Beacon-related malware components compiled in late August 2023, including regsvr.dll on August 21 and mokpp9342jktihh.dll on August 29. These timestamps indicate preparation of the payloads used in the campaign.
RARLAB issued a beta patch to address CVE-2023-38831 after the vulnerability was discovered. This was the first cited vendor fix for the WinRAR flaw.
Group-IB discovered the underlying WinRAR ZIP-processing vulnerability CVE-2023-38831. The flaw affects WinRAR versions before 6.23 and can lead to arbitrary code execution via a crafted archive.
Cyble Research and Intelligence Labs identified a spear-phishing campaign targeting a leading Russian semiconductor supplier. The email spoofed a consultant from Russia’s Ministry of Industry and Trade and used a crafted archive named "resultati_sovehchaniya_11_09_2023.rar" to exploit CVE-2023-38831 and deliver the Athena agent of the Mythic C2 framework.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers attributed a January 2026 cyberespionage campaign against Ukrainian government, military, and critical infrastructure organizations to the Russia-linked Gamaredon group, which used booby-trapped spearphishing attachments and malicious RAR archives exploiting WinRAR path traversal flaw **`CVE-2025-8088`** for initial access. The infection chain dropped an HTA payload dubbed **GammaPhish**, which launched via `mshta.exe` and fetched follow-on VBScript components including **GammaLoad**, **GammaWorm**, and **GammaSteel**. Sekoia said the operation marks a shift from Gamaredon’s older Pteranodon tooling to a fragmented, modular ecosystem in which multiple stages can independently act as backdoors and retrieve arbitrary remote code. The malware emphasized stealth, persistence, and resilient command-and-control. **GammaWorm** established persistence through scheduled tasks and RunOnce registry keys, hid modules in **NTFS Alternate Data Streams**, and spread through USB devices and network shares using malicious LNK shortcuts, including into air-gapped environments. Command-and-control discovery relied on dead-drop resolvers hosted on **Telegram**, **Telegra.ph**, **graph.org**, **Teletype**, **Cloudflare Workers**, and operator infrastructure, while **GammaSteel** staged dozens of DPAPI-encrypted modules in the registry and exfiltrated selected files to **AWS S3** or other S3-compatible storage with fallback to attacker-controlled servers. Because fresh payloads can be fetched at multiple stages, researchers warned that confirmed compromises may require full system wiping.
Jun 29, 2026
**Google Threat Intelligence Group (GTIG)** reported ongoing, widening exploitation of a high-severity WinRAR path traversal flaw, **CVE-2025-8088**, roughly six months after it was disclosed and patched by RARLAB. GTIG assessed exploitation began as early as **July 18, 2025** (including activity nearly two weeks before the vendor fix) and has expanded across a diverse set of adversaries, spanning **Russia- and China-linked espionage actors** as well as **financially motivated cybercriminals**. Reported targeting includes military, government, and technology organizations, with multiple Russia-aligned operations focusing on **Ukrainian** entities. Technical reporting indicates the vulnerability abuses **Windows Alternate Data Streams (ADS)** within crafted archives to perform directory traversal and write files to arbitrary locations, including the Windows **Startup** folder for persistence. GTIG and other researchers describe exploit chains where a user opens a benign decoy (e.g., a PDF) while hidden ADS entries extract and drop executable content such as `LNK`, `HTA`, `BAT`, `CMD`, or script files that run at login; observed payloads include **remote access trojans, infostealers**, and malware frameworks used by named state actors (e.g., **RomCom/UNC4895**, **APT44**, **TEMP.Armageddon**, **Turla**) in addition to broader criminal activity across multiple regions.
Jun 29, 2026
A financially motivated malware operation targeted businesses in Croatia, Serbia, Montenegro, and Bosnia and Herzegovina with tax-themed phishing that impersonated official institutions and delivered decoy PDF files alongside malware. Researchers said the campaign, active from at least 2016 to 2019, focused largely on financial and accounting staff and deployed two complementary tools: **BalkanDoor**, a backdoor capable of remote shell access, screenshot capture, and unlocking Windows sessions, and **BalkanRAT**, which abused legitimate Remote Utilities software for hidden remote desktop access. The attackers later incorporated the WinRAR ACE archive path traversal flaw, tracked as **`CVE-2018-20250`**, to install payloads by writing files to attacker-chosen locations on victim systems. Separate reporting showed the same WinRAR vulnerability was exploited in multiple campaigns to achieve persistence and code execution, often by dropping files into startup paths, and was also used to deliver malware including **Netwire RAT**, **QuasarRAT**, **Azorult**, **Razy**, **Buzy**, **PowerShell Empire**, and FireEye’s **SappyCache**. The flaw was fixed in **WinRAR 5.70**, but researchers warned that the product’s lack of auto-update left many systems exposed.
Aug 15, 2026