Critical WinRAR Vulnerability CVE-2025-8088 Exploited Globally

Google Threat Intelligence Group has issued an urgent alert regarding the widespread exploitation of a critical path traversal vulnerability in WinRAR that allows state-sponsored and financial attackers to silently plant malware on Windows systems.

The security flaw, tracked as CVE-2025-8088, enables hackers to craft malicious archives that appear to contain benign files like PDFs while utilizing Alternate Data Streams to hide a secondary payload. When a user opens the archive with an unpatched version of WinRAR, the software is tricked into writing a malicious file directly into the Windows Startup folder. This technique ensures that the malware executes automatically every time the user logs into their computer, providing the attacker with persistent access without further user interaction. Although a patch was released in late July 2025 with WinRAR version 7.13, the continued use of this "n-day" vulnerability highlights a significant gap in corporate patching cycles and user awareness.

The exploitation of this bug is exceptionally diverse, involving prominent government-backed threat actors from Russia and China alongside financially motivated cybercriminals. Russian-linked groups such as APT44 and Turla have been observed using the flaw to target Ukrainian military and government entities with custom malware like NESTPACKER and STOCKSTAY. Simultaneously, Chinese-nexus actors are utilizing the exploit to deliver the POISONIVY backdoor. In the criminal underground, the vulnerability has been commoditized by exploit suppliers like "zeroplayer," who facilitate the deployment of commodity Trojans and information stealers against the hospitality, travel, and banking sectors globally.

To defend against these orchestrated campaigns, organizations must prioritize updating WinRAR to version 7.13 or higher across all endpoints immediately. Security teams are also encouraged to monitor the Windows Startup directory for unauthorized shortcut files or scripts and utilize advanced email filtering services that can identify the specific path traversal signatures within RAR archives. Because the exploit relies on the underlying "Alternate Data Streams" feature of the Windows NTFS file system, traditional antivirus may not always flag the hidden payload inside the archive, making rapid software updates the most effective line of defense.