Critical WinRAR Bug CVE-2023-38831 Exploited by Russian APT Groups

Key Takeaways

• Russian state-sponsored groups are actively exploiting a known WinRAR vulnerability (CVE-2025-8088) to target Ukrainian entities.
• The flaw, patched in July 2025, continues to be weaponized due to a lack of automatic updates in WinRAR, leaving many systems exposed.
• Attackers leverage spear-phishing with malicious RAR archives to deploy sophisticated information stealers like an evolved GIFTEDCROOK.
• The malware exfiltrates sensitive data, including passwords, cookies, and files, while employing advanced evasion techniques.
• Immediate patching to WinRAR version 7.13 or later is critical, alongside proactive threat hunting and network perimeter defense.

Persistent WinRAR Vulnerability Fuels Russian APT Attacks Against Ukraine

Despite being patched nearly a year ago, a critical vulnerability in WinRAR (CVE-2025-8088) is still being actively exploited by Russian state-sponsored threat actors. These groups are systematically targeting Ukrainian organizations to pilfer sensitive data, including passwords, session cookies, and confidential files. The continued weaponization of this flaw underscores the persistent threat posed by unpatched software, serving as a reliable entry point for determined adversaries.

Two distinct Russian intrusion sets have been observed independently leveraging this same vulnerability. The first, identified as SHADOW-EARTH-066 and tracked by CERT-UA as UAC-0226, has deployed an updated iteration of its GIFTEDCROOK information stealer. The second group is Earth Dahu, also known as Gamaredon, a highly active Russia-aligned entity that has targeted Ukraine since at least 2013. Both groups continued to produce new exploit samples through April 2026, indicating sustained campaigns.

According to a report by analysts at Trend Micro, both campaigns initiate with spear-phishing emails containing malicious RAR archives. When a victim opens such an archive using an outdated WinRAR version, a decoy PDF is displayed, while hidden malicious files are covertly dropped into the Windows Startup folder. Crucially, no warning is presented to the user, and upon the next system login, the payload chain automatically executes.

Targeting and Tactics

SHADOW-EARTH-066 has focused its efforts on Ukrainian military innovation centers, law enforcement agencies, and local government bodies situated near Ukraine’s eastern border. Earth Dahu, leveraging the same WinRAR flaw, has utilized HTML Application files delivered via Cloudflare Workers to deploy its espionage tools. Despite employing different toolsets and delivery mechanisms, both groups exploited the identical, unpatched vulnerability as their initial access vector. Other Russia-linked actors, including notorious groups such as Sandworm, Turla, and Void Rabisu, have also been observed exploiting this specific vulnerability.

This ongoing abuse of a patched flaw highlights a significant systemic weakness: WinRAR lacks native automatic update capabilities or standard enterprise patch management channels. This deficiency makes it challenging for organizations to ensure all instances of the software are updated, leaving vulnerable versions operational and ripe for exploitation.

Technical Details of CVE-2025-8088 Exploitation

CVE-2025-8088 is a path traversal vulnerability with a CVSS score of 8.4. This flaw permits an attacker to write files silently outside the intended extraction directory by abusing NTFS Alternate Data Streams. The malicious archives contain a visible decoy PDF alongside three hidden components: an LNK shortcut dropped into the Startup folder, a PowerShell loader placed in C:ProgramData, and an encoded DLL in the same location.

Upon the next user login, the LNK file triggers a nested PowerShell session. This session decodes and loads the final payload entirely in memory using direct NT system calls, a technique designed to bypass common API hooks and evade detection. The ultimate payload is a DLL, internally named result.dll, which represents an advanced evolution of the GIFTEDCROOK information stealer. It targets popular web browsers such as Chrome, Edge, Opera, and Firefox, extracting passwords, session cookies, and master decryption keys. Additionally, it scans for files across 35 different extensions, including spreadsheets, email archives, and KeePass databases.

Exfiltrated data is encrypted using a dual-layer RC4 scheme before being transmitted over HTTPS to dedicated command-and-control (C2) servers. Following successful data exfiltration, the malware meticulously deletes all staging files and removes its Startup entry, leaving minimal forensic traces on the compromised system.

GIFTEDCROOK Evolves for Enhanced Evasion

The original GIFTEDCROOK, first documented in April 2025, was a standalone executable that transmitted stolen credentials via a hardcoded Telegram bot using plaintext tokens. By February 2026, SHADOW-EARTH-066 had significantly upgraded its attack chain, transitioning to the WinRAR exploit and replacing Telegram with encrypted HTTPS communication to C2 servers hosted in France, the Netherlands, and Switzerland. This update also incorporated a bypass for Chrome’s App-Bound Encryption, demonstrating the developers’ agility in adapting to browser security enhancements.

The PowerShell loaders are heavily obfuscated, employing random function names, extraneous comment lines, and sleep delays to thwart sandbox analysis. Furthermore, the encoded DLL payload is never written to disk in its decoded form, making file-based detection of the final malicious component exceedingly difficult.

What You Should Do

• Patch Immediately: Verify WinRAR versions across all endpoints and update to version 7.13 or later without delay.
• Proactive Threat Hunting: Scan for suspicious LNK or HTA files with randomized names within the Startup folder. Investigate C:ProgramData for short alphanumeric files (e.g., KKN, ND8).
• Network Perimeter Defense: Block known Command and Control (C2) IP addresses at the network perimeter. Refer to the provided Indicators of Compromise (IoCs) for specific addresses.
• Credential Rotation: In case of confirmed compromise, immediately rotate all saved browser credentials and terminate active sessions.
• Multi-Factor Authentication (MFA): Enable MFA on all critical accounts to add an essential layer of security.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.