WinRAR 2025: Nation-State & Cybercrime Groups Exploit Six-Month Software Flaw
In late July 2025, Google Threat Intelligence Group reported that both nation-state actors and financially motivated cybercriminals are actively exploiting a critical WinRAR path traversal vulnerability (CVE-2025-8088) that remained unpatched for over six months. The flaw was widely abused starting two weeks before RARLAB released a fix, allowing attackers to craft specially designed archive files. These malicious files executed code or dropped malware undetected onto victim systems, targeting government, military, and technology sectors—most notably Ukrainian entities—while criminal groups focused campaigns in Latin America, Indonesia, and Brazil. The widespread exploitation continues, leveraging malware and remote access tools for espionage and credential theft. The current landscape highlights accelerated adoption of public exploit tools by both advanced persistent threats and opportunistic criminals. The event underscores urgent industry challenges in rapid patching, software supply chain trust, and the escalating convergence of state and criminal cyber operations sharing technical tradecraft.
Kill Chain
