WinRAR path traversal flaw still exploited by numerous hackers
Recorded: Jan. 27, 2026, 8 p.m.
| Original | Summarized |
WinRAR path traversal flaw still exploited by numerous hackers News Featured New ClickFix attacks abuse Windows App-V scripts to push malware Microsoft patches actively exploited Office zero-day vulnerability Nearly 800,000 Telnet servers exposed to remote attacks Cloudflare misconfiguration behind recent BGP route leak OpenAI's ChatGPT ad costs are on par with live NFL broadcasts Fortinet blocks exploited FortiCloud SSO zero day until patch is ready Chinese Mustang Panda hackers deploy infostealers via CoolClient backdoor WinRAR path traversal flaw still exploited by numerous hackers Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityWinRAR path traversal flaw still exploited by numerous hackers WinRAR path traversal flaw still exploited by numerous hackers By Bill Toulas January 27, 2026 Multiple threat actors, both state-sponsored and financially motivated, are exploiting the CVE-2025-8088 high-severity vulnerability in WinRAR for initial access and to deliver various malicious payloads. In a report today, the Google Threat Intelligence Group (GTIG) says that exploitation started as early as July 18, 2025, and continues to this day from both state-backed espionage actors and lower-tier, financially motivated cybercriminals. Exploitation timelineSource: Google 7 Security Best Practices for MCP Related Articles: Actively Exploited Bill Toulas Previous Article Comments
Zurv - 4 hours ago oh my. Do people still install this?
xmris - 4 hours ago well, some people have no brain to update to the patched 7.13 and stay on an older version. Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Microsoft patches actively exploited Office zero-day vulnerability Microsoft investigates Windows 11 boot failures after January updates Microsoft releases emergency OOB update to fix Outlook freezes Sponsor Posts Get a free shadow AI inventory today Discover how phishing kits are sold and deployed. Download the full research report. Is your data already on a leak site? Monitor your exposure threats for free. Overdue a password health-check? Audit your Active Directory for free Exposure Management Index: Insights From 3,000+ Teams. Get The Report. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
This BleepingComputer article details the ongoing exploitation of a path traversal vulnerability (CVE-2025-8088) within the WinRAR archive utility by a diverse range of cyber threat actors. Google Threat Intelligence Group (GTIG) identified that this vulnerability, initially reported in early August 2025, is still actively exploited as of January 2026. The core of the issue lies in the ability of attackers to leverage Alternate Data Streams (ADS) to write malicious files to arbitrary locations within a system, often utilizing directory traversal techniques. The report identifies several distinct groups engaged in exploiting this flaw. State-sponsored actors, including UNC4895 (RomCom/CIGAR) and APT44 (FROZENBARENTS), have been deploying malware under the banners of NESTPACKER and LNK files, respectively, targeting Ukrainian military units. TEMP.Armageddon (CARPATHIAN) has been persistently dropping HTA downloaders into Startup folders, extending their activity into 2026. Additionally, Turla (SUMMIT) has utilized the vulnerability to deploy the STOCKSTAY malware suite, themed with Ukrainian army imagery. Finally, China-linked actors have employed the vulnerability to deploy POISONIVY, distributed as a BAT file that downloads additional payloads. Beyond state-sponsored threats, the article highlights the exploitation by financially motivated cybercriminals. Google researchers observed these actors distributing commodity remote access tools like XWorm and AsyncRAT, leveraging Telegram bot-controlled backdoors, and deploying malicious Chrome browser extensions for banking fraud. The article’s emphasis rests on the fact that these attackers sourced working exploits from specialized suppliers, most notably “zeroplayer,” who advertised a WinRAR exploit last July. This supplier has also marketed multiple high-value exploits targeting Microsoft Office sandbox escapes, corporate VPNs, Windows local privilege escalation, and bypassing security solutions (EDR, antivirus) for prices ranging from $80,000 to $300,000. This reflects the increasing commoditization of exploit development, reducing the complexity and friction in the cyberattack lifecycle and contributing to a rapid targeting of unpatched systems. The ongoing nature of this exploitation underscores several significant security concerns. First, the diversity of threat actors involved indicates a broad appeal of the vulnerability, making it attractive to both sophisticated nation-state groups and less experienced cybercriminals. Second, the commoditization of exploit development suggests a decrease in the cost of launching attacks, making attacks more feasible for a wider range of actors. Lastly, the fact that this vulnerability is still being actively exploited in 2026 demonstrates the urgency of patching systems to prevent further compromise. Google's analysis reinforces the critical need for regular patching and vulnerability scanning, alongside other foundational security measures, to mitigate the risk posed by exploited vulnerabilities like this path traversal flaw in WinRAR. |