Loading story…
Multiple threat groups exploited CVE-2023-38831, an arbitrary code execution vulnerability in WinRAR versions before 6.23, in campaigns reported during 2023. The flaw lets a specially crafted archive execute malicious code when a user opens an apparently harmless file inside it. Reported actors included DarkPink, Konni, SideCopy, APT29, UAC-0057, APT28, Sandworm, and APT40. Targets spanned government, defense, energy, financial trading, and cryptocurrency interests across Ukraine, Europe, India, Papua New Guinea, Vietnam, and Malaysia.
Attackers combined phishing and decoy documents with malicious scripts, DLL side-loading, and staged loaders to deliver backdoors, remote access Trojans, and information stealers, including DarkMe, Remcos, PicassoLoader, Rhadamanthys, and BOXRAT. Updating WinRAR to version 6.23 or later addresses the vulnerability. Defenders should identify outdated installations and investigate suspicious archive-opening activity using the published indicators of compromise, behavioral hunting guidance, and archive-focused YARA detection provided in the reports.
See which actors are running it and whether you're in range.
15 events from the most recent confirmed update back to the earliest known activity.
An October 9 campaign targeted Ukraine's government sector with a NATO-themed ZIP archive containing a benign PDF and a CMD file. The archive exploited CVE-2023-38831 to deliver Remcos RAT.
DarkPink exploited CVE-2023-38831 in October 2023 using PDF lures incorporating photocopied government documents. Its archives triggered DLL side-loading and a staged payload chain that installed the TelePowerBot remote-control Trojan.
China-backed APT40 launched a phishing campaign in late August 2023 using Dropbox links to malicious archives containing the exploit, a password-protected PDF, and an LNK file. Its ISLANDSTAGER loader established registry-based persistence and loaded BOXRAT, which used Dropbox for command and control.
UAC-0057 began exploiting CVE-2023-38831 in late August 2023, targeting Ukraine, including its critical energy sector. Its phishing chains used scripts, LNK files, HTA content, and JavaScript, with Cobalt Strike and PicassoLoader among the associated payloads.
Attackers targeted financial traders with ZIP archives exploiting CVE-2023-38831 to deliver DarkMe, malware associated with Evilnum. The execution chain used a Cabinet self-extracting archive, cc.exe, and RunDLL to launch the backdoor.
The report dates use of a download domain associated with a Remcos delivery chain to April 17 through July 18, 2023. The chain used an NSIS installer and the Piskens.For187 PowerShell script to launch GuLoader, which downloaded and decrypted Remcos RAT.
The report places discovery of CVE-2023-38831 in April 2023. The vulnerability affects WinRAR versions before 6.23 and allows attacker-controlled code to execute when a user opens a seemingly benign file inside a crafted archive.
Mysterious Werewolf impersonated Russia's Ministry of Industry and Trade in phishing emails containing archives that exploited CVE-2023-38831. The attack used PowerShell to download an Athena agent, established persistence through a scheduled task running every 10 minutes, and received attacker commands through Discord.
Uptycs published network indicators, process-event hunting logic for suspicious execution from WinRAR temporary paths, and the Uptycs_CVE_2023_38831_PK_FILES YARA rule. The rule checks for a ZIP header and an archive-entry naming pattern associated with exploitation.
Attackers exploited CVE-2023-38831 to deliver Agent Tesla using a CMD file disguised as a PDF inside a same-named folder.
Sandworm distributed invitation-themed phishing emails impersonating a Ukrainian drone warfare training school. The attached ZIP archives exploited CVE-2023-38831 to deploy Rhadamanthys, an information stealer targeting browser, KeePass, and cryptocurrency-wallet data.
Russia-associated APT28 used a crafted HTML page to entice Ukrainian energy-sector victims into downloading an exploit-bearing archive. Another documented APT28 chain opened a decoy PDF, established a reverse SSH shell, and ran IRONJAW to steal browser login data and local-state directories.
APT29 used an archive containing PDF, image, and BAT files under the lure DIPLOMATIC-CAR-FOR-SALE-BMW to target European victims. The BAT script attempted to retrieve a PowerShell payload from an ngrok-hosted endpoint that researchers found inactive during analysis.
Pakistan-associated SideCopy exploited WinRAR using lures impersonating the All India Association of Non Gazetted Officers and files named Achievements_of_DMF. The malicious executable contacted infrastructure associated with remote access Trojan delivery.
North Korea-associated Konni used a Qbao Network-themed archive to target cryptocurrency interests. Its executable masqueraded as an HTML file, checked system architecture, downloaded a payload, and collected system information for transmission to command-and-control infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 33 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
cloudsecurityalliance.org
Open sourceuptycs.com
Open sourcebi.zone
Open sourceblog.google
Open sourcepaper.seebug.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are exploiting **CVE-2025-8088**, a path traversal vulnerability affecting WinRAR versions earlier than **7.13**, to gain initial access through malicious RAR archives delivered by spear-phishing. Crafted archives write payloads outside the intended extraction directory, potentially enabling arbitrary code execution through shortcuts or other launch mechanisms. Italy’s CSIRT reported active exploitation in August 2025, following RARLAB’s July 30 patch release, and noted that a public proof-of-concept exploit was available. Threat Landscape subsequently reported multiple unnamed intrusion sets using the flaw to deploy **Amaranth Loader**, with follow-on tooling including the Havoc framework and a Telegram-controlled remote access trojan. The campaigns conceal payloads using Alternate Data Streams and employ HTTPS, commercial CDN fronting, geofencing, and short-lived domains to reduce exposure to scanning and sandbox analysis. Continued exploitation despite the available fix makes updating all vulnerable WinRAR installations to version 7.13 or later a priority; defenders should also investigate suspicious archive extraction, unexpected file writes, and shortcut-triggered execution.
Oct 9, 2026
**Google Threat Intelligence Group (GTIG)** reported ongoing, widening exploitation of a high-severity WinRAR path traversal flaw, **CVE-2025-8088**, roughly six months after it was disclosed and patched by RARLAB. GTIG assessed exploitation began as early as **July 18, 2025** (including activity nearly two weeks before the vendor fix) and has expanded across a diverse set of adversaries, spanning **Russia- and China-linked espionage actors** as well as **financially motivated cybercriminals**. Reported targeting includes military, government, and technology organizations, with multiple Russia-aligned operations focusing on **Ukrainian** entities. Technical reporting indicates the vulnerability abuses **Windows Alternate Data Streams (ADS)** within crafted archives to perform directory traversal and write files to arbitrary locations, including the Windows **Startup** folder for persistence. GTIG and other researchers describe exploit chains where a user opens a benign decoy (e.g., a PDF) while hidden ADS entries extract and drop executable content such as `LNK`, `HTA`, `BAT`, `CMD`, or script files that run at login; observed payloads include **remote access trojans, infostealers**, and malware frameworks used by named state actors (e.g., **RomCom/UNC4895**, **APT44**, **TEMP.Armageddon**, **Turla**) in addition to broader criminal activity across multiple regions.
Jun 29, 2026
Google Threat Intelligence Group reported broad exploitation of **CVE-2025-8088**, a critical WinRAR path traversal vulnerability that lets attackers use malicious RAR archives with Windows Alternate Data Streams to write files to arbitrary locations. In observed attacks, the flaw was commonly used to drop payloads into the Windows Startup folder so malware would execute at the next user logon, giving intruders persistence after a victim opened a crafted archive. The activity has been linked to both state-backed and financially motivated actors, including clusters associated with Russia and China, with targeting focused on military, government, and technology organizations. Exploitation began as early as July 18, 2025, and continued after RARLAB released a fix in **WinRAR 7.13** on July 30, 2025, turning the issue into an actively abused n-day vulnerability; defenders were urged to patch quickly, keep archive software updated, and rely on protections such as Safe Browsing and Gmail filtering to block weaponized files.
Jun 29, 2026