ESET researchers have uncovered a new vulnerability in WinRAR that is currently being exploited by the Russia-aligned group RomCom. This marks the third time RomCom has been caught exploiting a significant zero-day vulnerability in the wild. Previous instances include the abuse of CVE-2023-36884 through Microsoft Word in June 2023, and the exploitation of the combined vulnerabilities assigned CVE‑2024‑9680 chained with another undisclosed vulnerability in Windows, CVE‑2024‑49039, targeting vulnerable versions of Firefox, Thunderbird, and the Tor Browser, resulting in arbitrary code execution within the user’s session in October 2024.
Key points of this blogpost:
- If you use WinRAR or other affected components such as the Windows versions of its command line utilities, UnRAR.dll, or the portable UnRAR source code, upgrade immediately to the latest version.
- On July 18th, 2025, ESET researchers discovered a previously unknown zero-day vulnerability in WinRAR being exploited in the wild.
- Analysis of the exploit led to the discovery of the vulnerability, now assigned CVE-2025-8088: a path traversal vulnerability, made possible with the use of alternate data streams. After immediate notification, WinRAR released a patched version on July 30th, 2025.
- The vulnerability allows hiding malicious files in an archive, which are silently deployed when extracting.
- Successful exploitation attempts delivered various backdoors used by the RomCom group, specifically a SnipBot variant, RustyClaw, and Mythic agent.
- This campaign targeted financial, manufacturing, defense, and logistics companies in Europe and Canada.
RomCom profile
RomCom (also known as Storm-0978, Tropical Scorpius, or UNC2596) is a Russia-aligned group that conducts both opportunistic campaigns against selected business verticals and targeted espionage operations. The group’s focus has shifted to include espionage operations collecting intelligence, in parallel with its more conventional cybercrime operations. The backdoor commonly used by the group is capable of executing commands and downloading additional modules to the victim’s machine.
The discovery of CVE-2025-8088
On July 18th, 2025, we observed a malicious DLL named msedge.dll in a RAR archive containing unusual paths that caught our attention. Upon further analysis, we found that the attackers were exploiting a previously unknown vulnerability affecting WinRAR, including the then-current version, 7.12. On July 24th, 2025, we contacted the developer of WinRAR, and on the same day, the vulnerability was fixed and WinRAR 7.13 beta 1 published. WinRAR 7.13 was published on July 30th, 2025. Users of WinRAR are advised to install the latest version as soon as possible to mitigate the risk. Note that software solutions relying on publicly available Windows versions of UnRAR.dll or its corresponding source code are affected as well, especially those that have not updated their dependencies.
The vulnerability, tracked as CVE-2025-8088, uses alternate data streams (ADSes) for path traversal. Note that a similar path traversal vulnerability (CVE‑2025‑6218) affecting WinRAR was disclosed on June 19th, 2025, approximately a month earlier.
The attackers specially crafted the archive to apparently contain only one benign file (see Figure 1), while it contains many malicious ADSes (there’s no indication of them from the user’s point of view).
Once a victim opens this seemingly benign file, WinRAR unpacks it along with all its ADSes. For example, for Eli_Rosenfeld_CV2 – Copy (10).rar, a malicious DLL is deployed into %TEMP%. Likewise, a malicious LNK file is deployed into the Windows startup directory, thereby achieving persistence via execution on user login.
To ensure higher success, the attackers provided multiple ADSes with increasing depths of parent directory relative path elements (..\\). However, this introduces nonexistent paths that WinRAR visibly warns about. Interestingly, the attackers added ADSes that contain dummy data and are expected to have invalid paths. We suspect that the attackers introduced them so that the victim does not notice the suspicious DLL and LNK paths (see Figure 2). Only when scrolling down in the WinRAR user interface are the suspicious paths revealed, as seen in Figure 3.
Compromise chain
According to ESET telemetry, such archives were used in spearphishing campaigns from the 18th to 21st July, 2025, targeting financial, manufacturing, defense, and logistics companies in Europe and Canada. Table 1 contains the spearphishing emails – sender, subject, and filename of the attachment – used in the campaigns, and Figure 4 shows the message we observed in an email. In all cases, the attackers sent a CV hoping that a curious target would open it. According to ESET telemetry, none of the targets were compromised.
Table 1. Rewrite the observed Spearphishing emails from ESET telemetry:
1. Sender: Simona <2constheatcomshirl@seznam.cz>
Subject: Experienced Web3 Developer – CV Attached for Consideration
Attachment: Eli_Rosenfeld_CV2.rar
2. Sender: Marshall Rico
Subject: Motivated Applicant – Resume Enclosed
Attachment: cv_submission.rar
3. Sender: Russell Martin
Subject: Job Application
Attachment: Datos adjuntos sin título 00170.dat
4. Sender: Pepita Cordero
Subject: Application for Job Openings – Pepita Cordero
Attachment: JobDocs_July2025.rar
5. Sender: Sacchetti Jami
Attachment: Recruitment_Dossier_July_2025.rar
6. Sender: Jennifer Hunt
Subject: Applying for the Role
Attachment: cv_submission.rar
These emails contain malicious attachments that, when opened, execute a series of malicious actions. The attachments typically include a LNK file that is unpacked to the Windows startup directory, and a DLL or EXE file that is unpacked to either %TEMP% or %LOCALAPPDATA%. The malware used in these emails has been attributed to the RomCom threat actor group based on their targeted region, tactics, techniques, and malware signatures. In June 2023, the group conducted a spearphishing campaign targeting defense and governmental entities in Europe, using lures related to the Ukrainian World Congress. The campaign involved sending emails with a Microsoft Word document attachment that aimed to exploit the CVE‑2023‑36884 vulnerability, as detailed by the BlackBerry Threat Research and Intelligence team.
On October 8th, 2024, the group exploited a previously unknown vulnerability in the Firefox browser. This exploit targeted a use-after-free vulnerability in Firefox Animation timelines, allowing the attacker to execute code in a content process to deliver the RomCom backdoor. The vulnerability was identified as CVE‑2024‑9680 and was reported in a WeLiveSecurity blogpost.
Additionally, it was noted that another threat actor independently discovered and exploited the same vulnerability, CVE‑2025‑8088, shortly after RomCom began exploiting it. This information was shared by the Russian cybersecurity company BI.ZONE.
The RomCom group’s use of a zero-day vulnerability in WinRAR demonstrates their commitment to investing significant effort and resources into cyber operations. This marks at least the third instance of RomCom utilizing a zero-day vulnerability in their targeted attacks, indicating a persistent focus on acquiring and leveraging exploits for specific objectives. The targeted sectors align with the typical interests of Russian-aligned APT groups, suggesting a geopolitical motive behind the operation.
Acknowledgment was given to the WinRAR team for their prompt response and collaboration in releasing a patch within a day. Gratitude was also expressed to Peter Košinár for his assistance in the analysis.
For inquiries regarding research published on WeLiveSecurity, contact threatintel@eset.com. ESET Research provides private APT intelligence reports and data feeds, with more information available on the ESET Threat Intelligence page.
A list of indicators of compromise (IoCs) and samples can be found in the GitHub repository maintained by ESET. The repository includes details of files, their SHA-1 hashes, filenames, detection information, and descriptions.
Furthermore, a table detailing network indicators, such as IPs, domains, hosting providers, and first seen dates, is provided to aid in identifying and tracking malicious activity.
The report also outlines MITRE ATT&CK techniques used by the RomCom group, including resource development, initial access methods, execution tactics, persistence strategies, and defense evasion techniques. Each technique is linked to the relevant MITRE ATT&CK framework for further reference and analysis. Hey there! Just a heads up, before executing, RomCom also verifies a hardcoded domain name. This ensures that it maintains a level of legitimacy and security by checking for specific digital signatures.
If you want to dive deeper into RomCom and its tactics, feel free to explore the various techniques it uses in different stages of its operation. From masquerading with invalid code signatures to collecting credentials from web browsers and files, RomCom covers a wide range of malicious activities.
And don’t forget about its data collection methods, which include archiving data in ZIP files, stealing browser information, capturing screenshots, and more. RomCom is thorough in its approach to gather sensitive information.
When it comes to communication, RomCom utilizes HTTP or HTTPS protocols for command and control, and encrypts its communication using SSL certificates for added security.
Lastly, RomCom’s ultimate goal is financial theft, targeting companies for monetary gain. Stay vigilant and informed to protect yourself from threats like RomCom.
For more detailed information and insights, check out the provided links. Stay safe and secure online!
[Check out ESET Threat Intelligence for more cybersecurity updates](https://www.eset.com/int/business/services/threat-intelligence/?utm_source=welivesecurity.com&utm_medium=referral&utm_campaign=wls-research&utm_content=update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability&sfdccampaignid=7011n0000017htTAAQ)
Remember, knowledge is power when it comes to staying safe in the digital world. phrase: “The cat is sitting on the windowsill.”
Rewritten phrase: “The windowsill is being occupied by the cat.” sentence to make it more concise:
“The company has decided to implement new safety protocols for all employees in response to recent workplace accidents.”
“The company will implement new safety protocols for all employees due to recent workplace accidents.”
