Google Says WinRAR’s CVE-2025–8088 Is Still Being Exploited — Here’s What’s Really Going On (and How to Stop It)

TL;DR: A high-severity path-traversal bug in WinRAR (CVE-2025–8088) lets attackers smuggle a file out of the archive’s intended folder and into places like the Windows Startup directory, leading to code execution on next logon. It was patched in WinRAR 7.13 (released July 30, 2025), but attackers — including state-aligned groups — are still abusing unpatched systems. Update now, turn on basic hardening, and add detections that look for suspicious file writes and LNK execution from %AppData%\Microsoft\Windows\Start Menu\Programs\Startup.

What CVE-2025–8088 Actually Is

CVE-2025–8088 is a path traversal flaw in WinRAR on Windows. In plain English: a malicious .rar can trick WinRAR into extracting a payload outside the folder you chose—most dangerously into Startup—so the payload runs automatically after reboot or the next user logon. Some campaigns hide the payload in Alternate Data Streams (ADS) inside a decoy file, which obstructs casual inspection and helps the dropper land in exactly the right path.

WinRAR fixed the issue in version 7.13. If you’re on 7.12 or earlier, you’re vulnerable. Note that WinRAR doesn’t auto-update, so many endpoints remain exposed.

Who’s Exploiting It (and Why It’s Not Just “Old News”)

Google’s Threat Intelligence team reported active exploitation by multiple actors, from financially motivated crews to government-backed groups linked to Russia and China. The same exploit technique keeps showing up across very different operations — because it’s simple, reliable, and lands persistence without admin rights.

The bug was first seen in the wild as a zero-day in mid-July 2025. ESET observed the RomCom (aka UNC4895/CIGAR) cluster using malicious RARs to deploy SnipBot/NESTPACKER, initially against European and Canadian targets. Since then, other Russian-aligned actors (e.g., Sandworm, Gamaredon, Turla) and criminal groups have adopted it to deliver commodity RATs like AsyncRAT and XWorm.

Security advisories from vendors and national CSIRTs echo the same message: exploitation is broad, persistent, and targets the long tail of unpatched systems.

How the Attack Chain Usually Works

1. Lure: Phishing email or message with a “must-open” archive — job application, invoice, legal document, or Ukraine-related lure themes.
2. Crafted Archive: Inside, a benign-looking decoy plus a hidden payload (often an LNK, BAT, or HTA) tucked into ADS.
3. Extraction Trick: When the user opens/extracts with a vulnerable WinRAR, the bug writes the payload to a targeted path (e.g., Startup).
4. Persistence & Execution: After logon/reboot, Windows automatically runs the dropped file, fetching a second-stage (RAT/stealer) or executing a loader.

Why this keeps working: users trust RARs; defenders often don’t monitor Startup as closely as Run keys/services; and many orgs haven’t pushed 7.13.

Quick Wins: Patch, Block, Detect

1) Patch management (non-negotiable)

• Update to WinRAR 7.13 or later everywhere. Remember lateral movement: developers and power users often keep personal copies in profile folders. Inventory for WinRAR.exe, UnRAR.dll, and third-party tools bundling UnRAR.

2) Reduce blast radius

• Don’t extract archives you didn’t request. Train users to open RARs in a sandbox VM for unknown senders.
• Block scriptable file types (LNK, HTA, JS, VBS) from email gateways when attached or archived.
• For EDR/Defender customers, enable ASR rules that block executable content from email/web and child-process creation from Office. (Principle applies across tools; exact rule IDs vary by vendor.)

3) Detections to add today

Look for:

• File creation in ...\Startup\ by WinRAR or its child processes.
• LNK/HTA/BAT written during archive extraction and executed on next logon.
• ADS usage during extraction (e.g., :Zone.Identifier, custom ADS names) followed by file writes outside the chosen directory.

If you use Sigma, several community rules track RomCom’s CVE-2025–8088 tradecraft — adapt them to your EDR/XDR.

Incident Response: If You Think You Got Hit

1. Preserve evidence: copy the original archive; capture WinRAR logs (if any), prefetch, and $MFT for the time window.
2. Hunt for persistence: check Startup folders and Run/RunOnce keys; list recent LNK files and their Target paths.
3. Outbound traffic: look for new C2 domains/IPs around the first reboot after the archive was opened.
4. Quarantine and reimage as needed; assume credential theft if a stealer is found.
5. Retrospective search: query mailboxes and endpoints for the same archive hash across your environment.

Why This Story Matters Beyond WinRAR

Three broader takeaways:

• N-day ≠ low risk. Months after a patch, exploitation can accelerate as working exploits are re-sold and operationalized.
• User interaction is enough. No admin rights needed; a single click plus a reboot is all it takes.
• Living off unpopular paths. Startup folders, ADS, and LNKs are “old school,” but they still defeat many default defenses when combined with a popular consumer app.

A Minimal Checklist You Can Share With Your Team

• Inventory WinRAR and dependencies; upgrade to 7.13+.
• Gatekeep RARs from unknown senders; extract in a sandbox when in doubt.
• Block risky filetypes at the email and web layers (inside archives too).

Add detections for Startup folder writes, LNK execution post-logon, ADS anomalies.

• Test your IR playbook for “malicious archive leads to persistence,” including comms and executive updates.
• Measure coverage: create a canary RAR in a lab that drops into Startup and confirm your tools alert/contain.

Further Reading

• Google Threat Intelligence: multi-actor exploitation, technique details (ADS + Startup).
• RARLAB release notes: WinRAR 7.13 patch and vulnerability description.
• ESET research: initial zero-day use by RomCom and delivery of **SnipBot**.
• NVD entry: CVE technical summary and discoverers.
• Dark Reading coverage: why exploitation persists months after the patch.
• The Hacker News report: active exploitation across state-aligned and criminal actors.