WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine

Russian-backed cyber attack groups exploited a WinRAR vulnerability (CVE-2025-8088) to deploy information stealers against Ukrainian targets.

• •SHADOW-EARTH-066 uses RAR archives with hidden NTFS ADS payloads to deliver GIFTEDCROOK stealer
• •Earth Dahu deploys GammaPhish HTA and GammaLoad VBScript modules for ongoing espionage
• •CVE-2025-8088 enables path traversal via NTFS ADS to write files outside extraction directory
• •Malware steals browser passwords, cookies, and specific documents from victim machines
• •Attackers switched from Telegram to dedicated C2 servers for command and control

This summary was automatically generated by AI based on the original article and may not be fully accurate.