Hackers Use WinRAR Vulnerability To Gain Persistent Control via Amaranth

Cyberpress • February 5, 2026

Share: View original

Cyber threat actors known as Amaranth-Dragon have exploited a critical WinRAR flaw, CVE-2025-8088, to target Southeast Asian governments.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Amaranth-Dragon Exploits WinRAR Vulnerability Against Southeast Asian Governments The cyber threat group Amaranth-Dragon has leveraged a critical vulnerability in WinRAR, identified as CVE-2025-8088, to gain persistent control over systems belonging to Southeast Asian governments. This exploitation follows the vulnerability's addition to the CISA KEV list, indicating active exploitation in the wild. 11 sources 32

Extracted Entities

APT Groups (1)

Amaranth-Dragon

Attack Types (1)

Zero-day Exploit

CVEs (1)

MITRE ATT&CK (1)

T1203 - Exploitation for Client Execution

Tools (1)