WinRAR Critical Flaw CVE-2023-38831 Exploited by Hackers Targeting CIS Governments

Key Takeaways

• A threat actor tracked as UAT-6275 (also TAG-193) has been exploiting a critical WinRAR vulnerability (CVE-2025-8088) to deploy malware.
• The attacks primarily target government organizations across the Commonwealth of Independent States (CIS), including Kazakhstan, Russia, and Belarus.
• The flaw allows attackers to place malicious executables in the Windows Startup folder, ensuring persistence upon system reboot.
• The campaign utilizes custom reverse shells, including PickleShell, Chvost, and Laplas, to establish remote access.
• A patch is available; users should update WinRAR to version 7.13 or later to mitigate the risk.

A sophisticated threat group, identified as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future, is actively exploiting a critical WinRAR path traversal vulnerability, CVE-2025-8088. This flaw enables the group to install malware on Windows systems, primarily targeting government entities throughout the Commonwealth of Independent States (CIS).

This exploitation highlights a concerning trend where a seemingly innocuous archive file can become a persistent remote access vector. By leveraging this unpatched vulnerability, attackers can ensure their malicious programs launch automatically each time a victim logs into their system.

The campaign centers on CVE-2025-8088, a path traversal vulnerability that permits specially crafted archives to write files to locations outside the user’s intended extraction directory. Researchers first observed UAT-6275 incorporating this method in April 2026. This new technique complements their existing arsenal, which includes older attack vectors like malicious Word macros, executable downloaders, and deceptive shortcut files. The broader operational timeline for this group spans from June 2025 to August 2026, as detailed in an October 14 research report by Cisco Talos and Recorded Future’s Insikt Group.

The joint investigation by Cisco Talos and Recorded Future successfully identified the malware used in these attacks and attributed the activity to UAT-6275. Their comprehensive report describes several bespoke reverse shells, dubbed PickleShell, Chvost, and Laplas. These tools facilitate remote command execution on compromised machines, allowing attackers to send instructions and retrieve results over remote connections.

UAT-6275 Exploits WinRAR Flaw for Persistent Access

The WinRAR attack, categorized as Chain D in the research, involved a RAR archive containing two legitimate-looking PDF decoy documents. Crucially, the archive also concealed payload records that exploited NTFS alternate data streams, a lesser-known Windows file system feature. This mechanism, combined with the WinRAR path traversal vulnerability, allowed the attackers to deposit the PickleShell malware directly into the current user’s Startup folder, bypassing the expected extraction location.

The archive contained ten hidden stream names, all pointing to the same malicious payload but configured with varying numbers of parent-folder steps. This design ensured the malware could be successfully placed in the Startup folder regardless of the specific extraction path chosen by the victim. A successful write operation meant the executable was placed without requiring administrative privileges, and the malware would then execute automatically upon the next user sign-in, granting the attackers a persistent foothold without further user interaction.

PickleShell is a C#/.NET reverse shell designed to masquerade as a legitimate Windows service component. Analysis revealed that the payload initiates a hidden command shell, relaying command input and output to its command-and-control (C2) server. Later iterations of PickleShell incorporated encrypted connections for enhanced stealth. Researchers also discovered a consistent identifier across nine different PickleShell samples, providing security teams with an additional method to detect related files, even if their filenames are altered.

Prior to the WinRAR exploit, UAT-6275’s activities, dating back to June 2025, often commenced with macro-enabled Word documents. When a victim enabled macros, the document would download and execute a secondary malicious program. Beginning in July, the group shifted to using PS2EXE downloaders, which package PowerShell scripts as Windows executables. These downloaders would fetch reverse-shell payloads and establish scheduled tasks to maintain persistence. The evolution of these stages indicates that the WinRAR exploit was an expansion of their existing toolkit rather than a complete replacement of older methods.

Diverse Delivery Paths Bolster Access

From October 2025, UAT-6275 also utilized malicious shortcuts that initiated PowerShell scripts to retrieve further malicious code from GitHub. Subsequent versions of these shortcuts were observed downloading PickleShell directly into the Startup folder. There are noted overlaps with previous Silent Lynx phishing campaigns, which employed similar government-themed attachments and shortcuts. While Talos reported these similarities, they continue to track UAT-6275 separately from YoroTrooper, as direct overlaps in indicators or toolsets between those two groups were not established.

Investigators gained significant insight into UAT-6275’s operations through three publicly exposed staging directories and a previously unknown GitHub repository. These resources provided access to the group’s payloads, tool lists, and infrastructure modifications. The GitHub repository’s commit history was particularly valuable, allowing researchers to trace malware updates and changes to C2 servers. The use of GitHub for malware delivery is not unique to UAT-6275, appearing in various unrelated campaigns. This underscores the importance for defenders to scrutinize script behavior rather than blindly trusting downloads from popular, seemingly legitimate platforms.

The observed victim base and lure themes indicate a broad targeting strategy across CIS nations, including Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. The targeted sectors encompassed diplomacy, economic planning, agriculture, environmental management, and energy. Decoy documents included an Armenian diplomatic letter and a proposal related to Turkmenistan’s Turkmennebit and Russia’s Orsk Oil Refinery, suggesting a keen interest in regional negotiations and resource supply chains.

Talos assessed with medium confidence that the threat actor has a connection to Kazakhstan, based on linguistic clues, testing submissions, infrastructure access patterns, and working hours consistent with UTC+5. This assessment, however, does not definitively establish government sponsorship. The investigation also uncovered Linux-compatible tools and a public FortiWeb exploit, though the joint report did not confirm any in-the-wild exploitation of FortiWeb systems by this actor.

What You Should Do

• Patch WinRAR Immediately: Update all affected WinRAR installations to version 7.13 or later to address CVE-2025-8088. Regular patching of all archive software is crucial.
• Monitor Startup Folders: Regularly review the %APPDATA%MicrosoftWindowsStart MenuProgramsStartup directory for any unexpected or suspicious executable files.
• Inspect Scheduled Tasks: Check for newly created or modified scheduled tasks that could be used for persistence.
• Detect Hidden PowerShell Sessions: Implement monitoring for hidden PowerShell sessions or unusual PowerShell activity.
• Scrutinize Downloads from Public Repositories: Exercise extreme caution with scripts downloaded from public platforms like GitHub, especially if they follow email attachments or archive extractions. Analyze script behavior rather than assuming safety based on the source platform.
• Comprehensive Incident Response: If a compromise is suspected, conduct a thorough incident review. Simply deleting the original malicious archive is insufficient; ensure any payloads already written to the Startup folder or other persistence mechanisms are removed. Connect file creation, process execution, and outbound network traffic during your investigation.
• Deploy Threat Intelligence: Utilize the provided ClamAV signatures and Snort rules from Talos, along with the hashes and network indicators, to enhance endpoint detection and log analysis during threat hunting and incident response.

Indicators of Compromise (IoCs):-

File Hashes

All hashes and their roles above come from the joint technical paper: “Break the Silence: Tracking Silent Lynx through Exposed Infrastructure.”

Network and Host Indicators

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.