WinRAR Vulnerability CVE-2025-8088 Continues to Be Exploited by Hackers

The ongoing exploitation of the WinRAR vulnerability CVE-2025-8088 highlights significant cybersecurity risks for users of this popular archiving utility. Despite a patch being released over six months ago, state-sponsored hackers and financially motivated attackers continue to leverage this path traversal vulnerability. The exploit often involves hiding malicious files within alternate data streams (ADS) of decoy files, such as PDFs, within RAR archives.

In July and August 2025, researchers identified the RomCom (Storm-0978) and Paper Werewolf (Goffee) attack groups utilizing CVE-2025-8088. These groups reportedly obtained their exploit from an exploit supplier known as ‘zeroplayer,’ which operates on dark web forums. This indicates a troubling trend where even less technically skilled threat actors can access sophisticated exploits.

Additionally, various Russian-nexus advanced persistent threats (APTs) have been observed using this vulnerability for cyber espionage against Ukrainian targets, including Sandworm (APT44), Trula (Secret Blizzard), and TEMP.Armageddon (CARPATHIAN). An unspecified China-nexus threat actor has also been linked to delivering the POISONIVY (Darkmoon) remote access trojan through this exploit.

The malware delivered via these compromised archives varies widely, including malicious Chrome extensions, backdoors, and information-stealing malware. This ongoing threat underscores the importance of vigilance among users, especially those in sensitive sectors like finance and hospitality.

With hundreds of millions of WinRAR users globally, the implications of this vulnerability are significant. Users are strongly advised to ensure they are using the latest version, WinRAR 7.13, which addresses both CVE-2025-8088 and another flaw, CVE-2025-6218. Notably, WinRAR does not have an automatic update feature, requiring users to manually download and install updates.

Understanding the Risks

The continued exploitation of CVE-2025-8088 reveals a broader issue of unpatched vulnerabilities being targeted by various threat actors. Organizations and individuals must be aware of the potential risks associated with outdated software and the ease with which attackers can exploit known vulnerabilities.

As threat actors increasingly utilize ready-to-use exploits, the technical barrier for entry into cybercrime diminishes. This trend allows a wider range of actors, from ransomware groups to state-sponsored entities, to leverage sophisticated capabilities without extensive technical knowledge.