Update WinRAR tools now - RomCom and others exploiting zero-day vulnerability - ESET Research

Aug 27, 2026

ESET Research reports a previously unknown zero-day vulnerability in WinRAR that is actively exploited in the wild under the guise of job-application documents. The attack uses path traversal via alternate data streams to hide malicious files inside crafted RAR archives, which are deployed silently when users extract them. The exploitation chain supports persistence by placing components in the Windows startup and staging backdoors associated with the RomCom group, targeting organizations in Europe and Canada.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages12

Reading Time30 min

AccessFree to download

Key points and timeline

Immediate upgrade guidance

Discovery, CVE assignment, and patch release

RomCom profile

The discovery of CVE-2025-8088

Observed malicious archive behavior

Path traversal using alternate data streams

Persistence mechanisms

Compromise chain and targeting

Spearphishing timing and geographies

WELIVESECURITY.COM PUBLICATION Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability Update WinRAR tools now: RomCom and others exploiting zeroday vulnerability ESET Research discovered a zero-day vulnerability in WinRAR being exploited in the wild in the guise of job application documents; the weaponized archives exploited a path traversal flaw to compromise their targets ESET researchers have discovered a previously unknown vulnerability in WinRAR, being exploited in the wild by Russia-aligned group RomCom. This is at least the third time that RomCom has been caught exploiting a significant zero-day vulnerability in the wild. Previous examples include the abuse of CVE-2023-36884 via Microsoft Word in June 2023, and the combined vulnerabilities assigned CVE-2024-9680 chained with another previously unknown vulnerability in Windows, CVE-2024-49039, targeting vulnerable versions of Firefox, Thunderbird, and the Tor Browser, leading to arbitrary code execution in the context of the logged-in user in October 2024. Key points of this blogpost: • If you use WinRAR or other affected components such as the Windows versions of its command line utilities, UnRAR.dll, or the portable UnRAR source code, upgrade immediately to the latest version. • On July 18th, 2025, ESET researchers discovered a previously unknown zero-day vulnerability in WinRAR being exploited in the wild. • Analysis of the exploit led to the discovery of the vulnerability, now assigned CVE-2025-8088: a path traversal vulnerability, made possible with the use of alternate data streams. After immediate notification, WinRAR released a patched version on July 30th, 2025. • The vulnerability allows hiding malicious files in an archive, which are silently deployed when extracting. • Successful exploitation attempts delivered various backdoors used by the RomCom group, specifically a SnipBot variant, RustyClaw, and Mythic agent. • This campaign targeted financial, manufacturing, defense, and logistics companies in Europe and Canada. ROMCOM PROFILE RomCom (also known as Storm-0978, Tropical Scorpius, or UNC2596) is a Russia-aligned group that conducts both opportunistic campaigns against selected business verticals and targeted espionage operations. The group’s focus has shifted to include espionage operations collecting intelligence, in parallel with its more conventional cybercrime operations. The backdoor commonly used by the group is capable of executing commands and downloading additional modules to the victim’s machine. THE DISCOVERY OF CVE-2025-8088 On July 18th, 2025, we observed a malicious DLL named msedge .dll in a RAR archive containing unusual paths that caught our attention. Upon further analysis, we found that the attackers were exploiting a previously unknown vulnerability affecting WinRAR, including the then-current version, 7.12. On July 24th, 2025, we contacted the developer of WinRAR, and on the same day, the vulnerability was fixed and WinRAR 7.13 beta 1 published. WinRAR 7.13 was published on July 30th, 2025. Users of WinRAR are advised to install the latest version as soon as possible to mitigate the risk. Note that software solutions relying on publicly available Windows versions of UnRAR.dll or its corresponding source code are affected as well, especially those that have not updated their dependencies. The vulnerability, tracked as CVE-2025-8088, uses alternate data streams (ADSes) for path traversal. Note that a similar path traversal vulnerability (CVE-2025-6218) affecting WinRAR was disclosed on June 19th, 2025, approximately a month earlier. The attackers specially crafted the archive to apparently contain only one benign file (see Figure 1), while it contains many malicious ADSes (there’s no indication of them from the user’s point of view) . Figure 1. Eli_Rosenfeld_CV2 - Copy (10) .rar opened in WinRAR Once a victim opens this seemingly benign file, WinRAR unpacks it along with all it

FAQs

What vulnerability affects WinRAR, and how is it exploited?

ESET identifies CVE-2025-8088, a path traversal vulnerability enabled by alternate data streams. Attackers hide malicious payloads in RAR archives so they are deployed silently when the archive is extracted.

What should users do to reduce risk?

Upgrade WinRAR (and any affected components such as UnRAR.dll or dependent solutions) immediately to the latest available version. ESET notes a patched release was published after the vulnerability was disclosed.

Who is behind the attacks and what targets were affected?

ESET links exploitation to the RomCom group (also known under several aliases). The spearphishing campaigns targeted financial, manufacturing, defense, and logistics companies in Europe and Canada, though ESET reports no compromised targets in observed telemetry.

Aug 27, 2026

Upload by Theodora