Russia's RomCom among those exploiting a WinRAR 0-day in highly-targeted attacks
(2025/08/11)
- Reference: 1754939307
- News link: https://www.theregister.co.uk/2025/08/11/russias_romcom_among_those_exploiting/
- Source link:
Russia-linked attackers found and exploited a high-severity WinRAR vulnerability before the maintainers of the Windows file archiver issued a fix.
The bug, tracked as [1]CVE-2025-8088 , is a path-traversal flaw that affects the Windows version of the decompression tool. It received an 8.4 CVSS rating and, according to WinRAR, has been patched in the newest version, 7.13, released on July 31.
"When extracting a file, previous versions of WinRAR, Windows versions of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked into using a path, defined in a specially crafted archive, instead of user specified path," according to the [2]security advisory .
[3]
So if you haven't already: update now, and check for [4]these indicators of compromise because [5]RomCom found and exploited the bug as a zero-day.
[6]
[7]
ESET researchers Anton Cherepanov, Peter Kosinar, and Peter Strycek discovered and reported the vulnerability, and told The Register that the Russia-aligned crew plus at least one other criminal group began abusing the security hole prior to the patch.
"Most RomCom-related activity occurred between July 18 and July 21," ESET senior malware researcher Anton Cherepanov told The Register , noting that the team hasn't observed any similar exploitation since then.
[8]
These RomCom exploits were very targeted attacks against financial, manufacturing, defense, and logistics companies in Europe and Canada, used in spearphishing campaigns disguised as job application documents. "According to ESET telemetry, there were approximately a dozen potential victims," Cherepanov said.
While RomCom didn't manage to compromise its intended targets, ESET reports, at least one other gang, Paper Werewolf, also [9]exploited CVE‑2025‑8088 around the same time, according to Russian cybersecurity company BI.ZONE. It's unclear how many of these attempts were successful.
Plus, "it's important to note that now that information about this vulnerability is publicly available, it's highly likely that other threat actors may adopt the same exploit," Cherepanov said.
[10]
And as BI.ZONE noted: at the end of June a miscreant who goes by "zeroplayer" posted an ad for a working WinRAR zero-day exploit for $80,000 on a cybercrime forum.
"This suggests that [CVE‑2025‑8088] may be related to this exploit," The Russian researchers wrote. "It is possible that the Paper Werewolf group acquired it and modified it to carry out their attacks."
ESET originally discovered the vuln after coming across a malicious DLL named msedge.dll in a RAR archive containing unusual paths. Upon further inspection, the threat hunters found that the attackers were exploiting a previously unknown WinRAR bug.
CVE-2025-8088 uses [11]alternate data streams (ADSes) for path traversal," the ESET trio wrote in a Monday report, noting that the Zero Day Initiative reported a similar WinRAR path traversal vulnerability ( [12]CVE‑2025‑6218 ) on July 19.
The attacks begin with a phishing email that looks like a job application and contains a CV that appears to be benign. However, this file also contains many malicious ADSes to increase the criminals' chances for successful compromise — but these are all hidden from the victim.
Once the victim opens the CV, however, WinRAR unpacks it along with all its ADSes. It also deploys a malicious LNK file into the Windows startup directory to achieve persistence via execution on user login.
RomCom backdoors
The RAR files always contain two malicious files: the LNK file and a DLL or EXE, and some of them also contain various RomCom backdoors including a SnipBot variant, RustyClaw, and Mythic agent.
The [13]Mythic agent attack chain contains a hardcoded domain name of the target. The malicious DLL file that decrypts and executes the shellcode also retrieves the domain name for the current machine, which includes the company name. If this doesn't match the hardcoded name of the target organization, the malware exits.
"This means that the attackers had conducted reconnaissance beforehand, confirming that this email was highly targeted," the ESET team noted.
The second execution chain contains a variant of SnipBot, which Palo Alto Networks' Unit 42 previously [14]attributed to RomCom by UNIT 42. The malicious executable, ApbxHelper.exe, is a modified version of [15]PuTTY CAC (a forked version fork of PuTTY), and is signed with an invalid code-signing certificate.
This one also uses an interesting anti-malware-analysis technique: it only executes the shellcode if the computer recently opened at least 69 earlier documents to ensure that the malware doesn't run in an empty virtual machine or sandbox.
[16]Ukraine war blurs lines between cyber-crims and state-sponsored attackers
[17]Miscreants exploit five Microsoft bugs as Windows giant addresses 130 flaws
[18]Paying for WinRAR in all the wrong ways - Russia and China hitting ancient app
[19]Fancy Bear goes phishing in US, European high-value networks
ESET researchers also spotted an identical executable, ApbxHelper.exe within Adverse_Effect_Medical_Records_2025.rar, uploaded to [20]VirusTotal from Germany. "This archive also exploits the CVE-2025-8088 vulnerability," the trio wrote.
In the third case, the malicious LNK file runs a downloader named [21]RustyClaw . It's written in Rust and Cisco Talos previously [22]attributed it to RomCom.
RustyClaw downloads and executes another payload that partially matches the analysis of MeltingClaw by [23]Proofpoint . MeltingClaw is also linked to RomCom.
According to ESET, this is at least the third time that RomCom has exploited a zero-day. This includes [24]CVE-2023-36884 , a [25]remote code execution (RCE) bug in Microsoft Word; [26]CVE‑2024‑9680 chained with another previously-unknown vulnerability in Windows; and [27]CVE‑2024‑49039 , targeting vulnerable versions of Firefox, Thunderbird, and the Tor Browser, which also leads to arbitrary code execution.
Plus, RomCom isn't the only Russia-linked crew to abuse WinRAR holes. [28]Fancy Bear , the GRU cyber-espionage crew, previously exploited [29]CVE-2023-38831 for large-scale phishing campaigns against high-value targets including government, defense, and aerospace agencies in the US and Europe. ®
Get our [30]Tech Resources
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-8088
[2] https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aJpn99JAbqbT_UXxyh4TrQAAAIs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://github.com/eset/malware-ioc/tree/master/romcom
[5] https://www.theregister.com/2023/06/01/ukraine_romcom_malware/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aJpn99JAbqbT_UXxyh4TrQAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aJpn99JAbqbT_UXxyh4TrQAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aJpn99JAbqbT_UXxyh4TrQAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://bi.zone/expertise/blog/paper-werewolf-atakuet-rossiyu-s-ispolzovaniem-uyazvimosti-nulevogo-dnya-v-winrar/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aJpn99JAbqbT_UXxyh4TrQAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3
[12] https://nvd.nist.gov/vuln/detail/CVE-2025-6218
[13] https://docs.mythic-c2.net/
[14] https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
[15] https://github.com/NoMoreFood/putty-cac
[16] https://www.theregister.com/2023/06/01/ukraine_romcom_malware/
[17] https://www.theregister.com/2023/07/11/microsoft_patch_tuesday/
[18] https://www.theregister.com/2023/10/18/china_russia_winrar/
[19] https://www.theregister.com/2023/12/06/fancy_bear_phishing_microsoft/
[20] https://www.virustotal.com/gui/file/2a8fafa01f6d3863c87f20905736ebab28d6a5753ab708760c0b6cf3970828c3
[21] https://blog.talosintelligence.com/uat-5647-romcom/
[22] https://blog.talosintelligence.com/uat-5647-romcom/
[23] https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader
[24] https://nvd.nist.gov/vuln/detail/CVE-2023-36884
[25] https://www.theregister.com/2023/07/11/microsoft_patch_tuesday/
[26] https://nvd.nist.gov/vuln/detail/CVE-2024-9680
[27] https://nvd.nist.gov/vuln/detail/CVE-2024-49039
[28] https://www.theregister.com/2023/12/06/fancy_bear_phishing_microsoft/
[29] https://nvd.nist.gov/vuln/detail/CVE-2023-38831
[30] https://whitepapers.theregister.com/
The bug, tracked as [1]CVE-2025-8088 , is a path-traversal flaw that affects the Windows version of the decompression tool. It received an 8.4 CVSS rating and, according to WinRAR, has been patched in the newest version, 7.13, released on July 31.
"When extracting a file, previous versions of WinRAR, Windows versions of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked into using a path, defined in a specially crafted archive, instead of user specified path," according to the [2]security advisory .
[3]
So if you haven't already: update now, and check for [4]these indicators of compromise because [5]RomCom found and exploited the bug as a zero-day.
[6]
[7]
ESET researchers Anton Cherepanov, Peter Kosinar, and Peter Strycek discovered and reported the vulnerability, and told The Register that the Russia-aligned crew plus at least one other criminal group began abusing the security hole prior to the patch.
"Most RomCom-related activity occurred between July 18 and July 21," ESET senior malware researcher Anton Cherepanov told The Register , noting that the team hasn't observed any similar exploitation since then.
[8]
These RomCom exploits were very targeted attacks against financial, manufacturing, defense, and logistics companies in Europe and Canada, used in spearphishing campaigns disguised as job application documents. "According to ESET telemetry, there were approximately a dozen potential victims," Cherepanov said.
While RomCom didn't manage to compromise its intended targets, ESET reports, at least one other gang, Paper Werewolf, also [9]exploited CVE‑2025‑8088 around the same time, according to Russian cybersecurity company BI.ZONE. It's unclear how many of these attempts were successful.
Plus, "it's important to note that now that information about this vulnerability is publicly available, it's highly likely that other threat actors may adopt the same exploit," Cherepanov said.
[10]
And as BI.ZONE noted: at the end of June a miscreant who goes by "zeroplayer" posted an ad for a working WinRAR zero-day exploit for $80,000 on a cybercrime forum.
"This suggests that [CVE‑2025‑8088] may be related to this exploit," The Russian researchers wrote. "It is possible that the Paper Werewolf group acquired it and modified it to carry out their attacks."
ESET originally discovered the vuln after coming across a malicious DLL named msedge.dll in a RAR archive containing unusual paths. Upon further inspection, the threat hunters found that the attackers were exploiting a previously unknown WinRAR bug.
CVE-2025-8088 uses [11]alternate data streams (ADSes) for path traversal," the ESET trio wrote in a Monday report, noting that the Zero Day Initiative reported a similar WinRAR path traversal vulnerability ( [12]CVE‑2025‑6218 ) on July 19.
The attacks begin with a phishing email that looks like a job application and contains a CV that appears to be benign. However, this file also contains many malicious ADSes to increase the criminals' chances for successful compromise — but these are all hidden from the victim.
Once the victim opens the CV, however, WinRAR unpacks it along with all its ADSes. It also deploys a malicious LNK file into the Windows startup directory to achieve persistence via execution on user login.
RomCom backdoors
The RAR files always contain two malicious files: the LNK file and a DLL or EXE, and some of them also contain various RomCom backdoors including a SnipBot variant, RustyClaw, and Mythic agent.
The [13]Mythic agent attack chain contains a hardcoded domain name of the target. The malicious DLL file that decrypts and executes the shellcode also retrieves the domain name for the current machine, which includes the company name. If this doesn't match the hardcoded name of the target organization, the malware exits.
"This means that the attackers had conducted reconnaissance beforehand, confirming that this email was highly targeted," the ESET team noted.
The second execution chain contains a variant of SnipBot, which Palo Alto Networks' Unit 42 previously [14]attributed to RomCom by UNIT 42. The malicious executable, ApbxHelper.exe, is a modified version of [15]PuTTY CAC (a forked version fork of PuTTY), and is signed with an invalid code-signing certificate.
This one also uses an interesting anti-malware-analysis technique: it only executes the shellcode if the computer recently opened at least 69 earlier documents to ensure that the malware doesn't run in an empty virtual machine or sandbox.
[16]Ukraine war blurs lines between cyber-crims and state-sponsored attackers
[17]Miscreants exploit five Microsoft bugs as Windows giant addresses 130 flaws
[18]Paying for WinRAR in all the wrong ways - Russia and China hitting ancient app
[19]Fancy Bear goes phishing in US, European high-value networks
ESET researchers also spotted an identical executable, ApbxHelper.exe within Adverse_Effect_Medical_Records_2025.rar, uploaded to [20]VirusTotal from Germany. "This archive also exploits the CVE-2025-8088 vulnerability," the trio wrote.
In the third case, the malicious LNK file runs a downloader named [21]RustyClaw . It's written in Rust and Cisco Talos previously [22]attributed it to RomCom.
RustyClaw downloads and executes another payload that partially matches the analysis of MeltingClaw by [23]Proofpoint . MeltingClaw is also linked to RomCom.
According to ESET, this is at least the third time that RomCom has exploited a zero-day. This includes [24]CVE-2023-36884 , a [25]remote code execution (RCE) bug in Microsoft Word; [26]CVE‑2024‑9680 chained with another previously-unknown vulnerability in Windows; and [27]CVE‑2024‑49039 , targeting vulnerable versions of Firefox, Thunderbird, and the Tor Browser, which also leads to arbitrary code execution.
Plus, RomCom isn't the only Russia-linked crew to abuse WinRAR holes. [28]Fancy Bear , the GRU cyber-espionage crew, previously exploited [29]CVE-2023-38831 for large-scale phishing campaigns against high-value targets including government, defense, and aerospace agencies in the US and Europe. ®
Get our [30]Tech Resources
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-8088
[2] https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aJpn99JAbqbT_UXxyh4TrQAAAIs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://github.com/eset/malware-ioc/tree/master/romcom
[5] https://www.theregister.com/2023/06/01/ukraine_romcom_malware/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aJpn99JAbqbT_UXxyh4TrQAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aJpn99JAbqbT_UXxyh4TrQAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aJpn99JAbqbT_UXxyh4TrQAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://bi.zone/expertise/blog/paper-werewolf-atakuet-rossiyu-s-ispolzovaniem-uyazvimosti-nulevogo-dnya-v-winrar/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aJpn99JAbqbT_UXxyh4TrQAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3
[12] https://nvd.nist.gov/vuln/detail/CVE-2025-6218
[13] https://docs.mythic-c2.net/
[14] https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
[15] https://github.com/NoMoreFood/putty-cac
[16] https://www.theregister.com/2023/06/01/ukraine_romcom_malware/
[17] https://www.theregister.com/2023/07/11/microsoft_patch_tuesday/
[18] https://www.theregister.com/2023/10/18/china_russia_winrar/
[19] https://www.theregister.com/2023/12/06/fancy_bear_phishing_microsoft/
[20] https://www.virustotal.com/gui/file/2a8fafa01f6d3863c87f20905736ebab28d6a5753ab708760c0b6cf3970828c3
[21] https://blog.talosintelligence.com/uat-5647-romcom/
[22] https://blog.talosintelligence.com/uat-5647-romcom/
[23] https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader
[24] https://nvd.nist.gov/vuln/detail/CVE-2023-36884
[25] https://www.theregister.com/2023/07/11/microsoft_patch_tuesday/
[26] https://nvd.nist.gov/vuln/detail/CVE-2024-9680
[27] https://nvd.nist.gov/vuln/detail/CVE-2024-49039
[28] https://www.theregister.com/2023/12/06/fancy_bear_phishing_microsoft/
[29] https://nvd.nist.gov/vuln/detail/CVE-2023-38831
[30] https://whitepapers.theregister.com/
Re: Bears
elsergiovolador
See! They don't sleep!
Email ... contains a CV that appears to be benign
that one in the corner
> Once the victim opens the CV, however, WinRAR unpacks it along with all its ADSes.
Perhaps it has been too long since I sent out a CV, but since when has receiving a dot-rar file for a CV been considered normal and benign? Or a dot-zip, dot-zoo or any other kind of archive?
Or this just another one of those "Windows by default doesn't show the actual extension, but everybody forgets this when they see emails (or even a directory) full of PDF CVs, so don't think anything of it when they see that all the files are presented as "jim brown", "jim green", "jim smith" etc but one of them shows as "jim jones.pdf" and has a different icon to all the others?
Although, yes, you do hope that unpacking an archive *is* a safe thing to do, so it isn't as bad as the people who we hear about clicking on "jim black.pdf.exe", but still...
Bears
Bears abuse holes.
I mean, that's one way to trigger censors at Online Safety Act ivory towers.