Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open

Two separate Russia-aligned campaigns are still exploiting the WinRAR flaw CVE-2025-8088 against Ukrainian organizations nearly a year after it was patched, showing how unmanaged software keeps an exploited entry point open long after the fix ships.

By: Hiroyuki Kakara, Feike Hacquebord 2026/06/08 Read time: ( words)

When Russia annexed Crimea in 2014, the Russia-aligned cyber threat landscape was defined by a handful of known actors: Pawn Storm (also known as APT28), Sandworm, Earth Koshchei (also known as APT29), Turla, and Earth Dahu (also known as Gamaredon). A decade later, those groups remain active, but they have been joined by a much larger number of distinct activity clusters targeting Ukraine. One pattern cuts across these clusters: the rapid adoption of vulnerabilities in widely used software. CVE-2025-8088 , the WinRAR vulnerability at the center of this report, was first reported in July 2025 as a zero-day used by Void Rabisu (ROMCOM) and has since been exploited by other groups, including Sandworm and Turla . SHADOW-EARTH-066 (known as UAC-0226) and Earth Dahu also exploited this vulnerability.

WinRAR is deeply embedded in daily operations across Ukrainian organizations, making it an attractive target for exploitation. CVE-2025-8088 is a path traversal flaw (CVSS 8.4), patched in WinRAR 7.13 in July 2025, that allows an attacker to silently write files outside the extraction directory via NTFS Alternate Data Streams. Once the victim opens the archive, no further interaction is needed; they see only a decoy document. All the samples we analyzed exploit this vulnerability.

In this report, we examine two separate campaigns that exploit CVE-2025-8088 against Ukrainian targets. The first is attributed to SHADOW-EARTH-066 and delivers an updated version of the GIFTEDCROOK information stealer that rapidly harvests credentials and documents before deleting itself. The second is attributed to Earth Dahu (Gamaredon) and delivers espionage tools through an HTA-based chain. The two groups use different tooling and infrastructure, but the same entry point.

Victims receive a RAR archive, typically through email. When they open the archive with an older version of WinRAR, a PDF appears. That PDF can look like a court summons (see Figure 1), an administrative notice, or a defense ministry document. Nothing else is visible to the victim, but in the background, WinRAR has silently written additional files to locations outside the extraction directory, such as the Windows Startup folder. No dialog or warning appears. The time the user logs in, the files execute.

Both campaigns examined in this post used CVE-2025-8088, which is related to an earlier directory traversal vulnerability (CVE-2025-6218, patched in WinRAR 7.12) but exploits a different code path through NTFS Alternate Data Streams (ADS).

ADS is a feature of the NTFS file system that allows additional named data streams to be attached to a file. Legitimate uses include metadata storage such as zone identifiers added by browsers, but ADS can also carry arbitrary data. RAR5 archives can include SERVICE headers (header type 0x03) with the STMz marker to represent ADS metadata. WinRAR before version 7.13 did not sanitize directory traversal sequences in these ADS names, allowing an attacker to embed ..\..\ sequences in the STMz entries and write files to arbitrary locations. Figure 2 illustrates this mechanism.

SHADOW-EARTH-066 is our temporary designation for the threat actor cluster tracked by CERT-UA as UAC-0226 , whose activities were first documented in CERT-UA advisory #14303 in April 2025. The campaign has targeted Ukrainian military innovation centers, military formations, law enforcement agencies, and local self-government bodies near Ukraine's eastern border since at least February 2025.

The original campaign used spear phishing emails with macro-enabled Excel files (.xlsm) that referenced demining, administrative fines, UAV production, and compensation for destroyed property. The payloads, stored as base64-encoded strings in Excel cells, included a .NET reverse shell and a C/C++ credential stealer that CERT-UA named GIFTEDCROOK . The first version was a standalone executable that stole browser credentials from Chrome, Edge, and Firefox, archived them with PowerShell's Compress-Archive, and exfiltrated the archive to a Telegram channel. The bot tokens and chat IDs were hardcoded in plaintext.

The most recent build artifact, dated April 9, 2026, indicates the campaign remained active through at least early April (the full attack chain is shown in Figure 3). The crafted RAR archives contain a visible decoy PDF alongside three hidden ADS payloads that use path traversal to write files outside the extraction directory:

These traversal depths are calculated to reach the user's AppData directory tree from a typical email client with a temporary extraction path. The LNK is placed in the Startup folder so that it executes on the login, triggering the payload chain. Twelve levels overshoot to the drive root, reaching C:\ProgramData\. From the victim's perspective, they extract the archive and see a PDF document. No warning is displayed, as the additional files are written silently in the background.

We analyzed multiple RAR samples across several distinct build groups. While file names, encoding keys, and C&C addresses differ between builds, all structural fingerprints: the DLL export name result.dll with a single Func export, the non-standard PE offset e_lfanew = 0x110, statically linked libcurl 8.14.0-DEV, identical RC4 exfiltration keys, and the same builder machine SID embedded in all LNK files. One sample (SHA256: 3d371ef71e40c34a75c168d4647db096c2f386499d99a88d4e16b63cd4acda25) is examined below.

This RAR archive drops a court summons PDF from the Dnipropetrovsk Regional Administrative Court as a decoy (as seen in Figure 2). The three hidden ADS payloads are:

Other samples use different decoy themes, including a Ministry of Defense registry of military obliges and military equipment manifests for KrAZ truck fleets.

When the victim logs in, Windows executes the LNK file from the Startup folder. The LNK target is cmd.exe with arguments that launch a double-nested PowerShell session:

cmd.exe /c start /min "" powershell -NoPr -Win Hidd -Ex Bypass -Com "powershell -NoPr -Ex Bypass -Com ""iex (gc 'C:\ProgramData\KKN' -raw)"""

The outer powershell.exe spawns an inner powershell.exe . Both use -ExecutionPolicy Bypass to circumvent script execution restrictions and -WindowStyle Hidden to suppress visible windows. The inner session reads the loader script from C:\ProgramData\ and executes it via Invoke-Expression. Each build uses a different alias for Get-Content (gc, cat, or type), varying the command-line signature without changing functionality.

The PowerShell loaders are heavily obfuscated scripts (65 to 74 KB). Functions are named with random English words joined by underscores (e.g., flexibility_denominator_wiretap(), polliwog_scenery_reward_plane_preset()). Hundreds of junk lines and Sleep calls with fractional values (e.g., Sleep 1.453) inflate the script and extend execution time to evade sandbox analysis (Figure 4).

Beneath the obfuscation, the loader performs in-memory DLL loading using direct NT system calls (NtAllocateVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx) to avoid user-mode API hooks:

The encoded payload does exist on disk under C:\ProgramData\, but the decoded DLL is never written as a file. The decoding and loading process runs in memory within the powershell.exe process, making file-based detection of the final payload difficult.

The final payload is a DLL internally named result.dll that exports a single function Func. The file is a custom information stealer compiled for x86-64 with libcurl 8.14.0-DEV statically linked. It targets Chromium-based browsers (Chrome, Edge, Opera) and Firefox, and also collects documents and files from the victim’s filesystem.

Table 1. Browser targets

For each Chromium-based browser (Chrome, Edge, Opera), the stealer reads the Local State JSON file and extracts the DPAPI-protected master key via CryptUnprotectData. It then collects Login Data (passwords) and cookies per profile, along with the decrypted master key. For Firefox, the stealer reads the NSS key databases key3.db and key4.db , along with cookies.sqlite from each profile directory.

The stealer also extracts app_bound_encrypted_key from Chrome’s Local State file. Chrome version 127 and later uses this field to implement App-Bound Encryption (ABE) , a protection that binds credential decryption to the Chrome application context. Google introduced ABE specifically to make infostealer malware less effective, but ABE bypass has been adopted in many infostealers since late 2024, and its presence in result.dll indicates the developer is tracking browser security changes and may have borrowed ideas from the broader infostealer ecosystem.

Beyond browser data, result.dll scans the victim’s Documents, Downloads, and TEMP directories for files matching 35 extensions:

Table 2. File extensions targeted for theft, by category

This file theft capability aligns with the evolution documented by Arctic Wolf , who reported that intermediate GIFTEDCROOK versions already added file collection before the shift to result.dll .

After exfiltration, result.dll removes all three staging artifacts from disk. The following delete operations then execute in sequence:

After cleanup, no startup mechanism and no staging files remain on the endpoint; the stealer operates as a one-shot execution.

To resist static and sandbox analysis, result.dll layers several techniques:

Before exfiltrating data, the DLL sends an HTTP GET to hxxp://1[.]1[.]1[.]1 as a connectivity check. The request uses Cloudflare’s public DNS IP on a non-standard port to verify internet access without depending on domain resolution.

Stolen credentials are encrypted with dual-layer RC4 , then sent via HTTPS POST as multipart/form-data to the /rcv/ path on dedicated C&C servers. The primary RC4 key also serves as the multipart boundary string.

Table 3. C&C server IP addresses and ports

*Note that we have not observed any samples communicating directly with these IP addresses. They are hosts pivoted via a self-signed TLS certificate with CN “john” that overlaps with the top four IPs listed in the table.

All seven servers are hosted on Evoxt Sdn. Bhd. (AS149440), a Malaysian VPS provider with points of presence across Europe. These servers are distributed across France, the Netherlands (two servers), and Switzerland. All use non-standard high ports and the same URI path (/rcv/), indicating shared server-side tooling.

Our analysis confirms that result.dll belongs to the same malware family as GIFTEDCROOK. The two the same compiler toolchain (MSVC C++, x64), the same cryptographic API set (CryptUnprotectData, CryptImportKey, BCryptGenRandom), the same anti-analysis checks (IsDebuggerPresent, wine_get_version), and the same multipart/form-data exfiltration format.

The C++ runtime patterns indicate the same C++20 standard., while the libcurl version was upgraded from 8.12.1-DEV to 8.14.0-DEV. Intermediate versions (v1.2 and v1.3, documented by Arctic Wolf ) had already added file theft capabilities while still using Telegram for exfiltration; result.dll continues and extends this trajectory.

The changes represent a substantial upgrade:

Table 4. GIFTEDCROOK vs. result.dll: feature-by-feature comparison

The shift from Telegram to dedicated C&C servers is notable for operational security, and it also possibly tracks with a broader change in the operating environment: in February 2026, Russia began severely restricting access to Telegram, throttling the service before moving toward a full block. The original GIFTEDCROOK samples contained plaintext Telegram bot tokens that could be trivially extracted and used for monitoring or takedown. In the new version, C&C URLs are RC4-encrypted in the binary’s .rdata section. They can still be recovered statically by RC4-decrypting the adjacent key-blob pairs, but they are no longer visible through basic string analysis.

Earth Dahu is our designation for the threat actor commonly known as Gamaredon (also tracked as Primitive Bear, Shuckworm, Aqua Blizzard, UAC-0010, BlueAlpha, and ACTINIUM). The group is one of the most prolific Russia-aligned groups targeting Ukraine, with documented operations since at least 2013. Earth Dahu, which has historically favored script-based tooling, adopts new delivery techniques as older ones are detected and blocked, which includes Office macros, self-extracting archives (SFX), BAT scripts, and vulnerability exploitation such as CVE-2025-8088.

Since at least September 2025, Earth Dahu has also incorporated CVE-2025-8088 into its operations. We first reported on this adoption in a private intelligence report distributed through TrendAI Vision One™︎ in December 2025, when Earth Dahu used the vulnerability with an HTA-to-VBScript infection chain that delivered espionage modules. Based on RAR internal file timestamps and file naming conventions, the chain remained active through at least April 10, 2026.

This section focuses on Earth Dahu's exploitation of CVE-2025-8088 as an initial access vector. Post-exploitation TTPs, including the delivery of GammaSteel and other espionage modules, are documented by ClearSky and HarfangLab ; we refer readers to those reports for detailed coverage.

Unlike SHADOW-EARTH-066’s three-file approach, Earth Dahu’s CVE-2025-8088 exploitation drops a single file via ADS path traversal: a malicious HTA (HTML Application) , or a VBS or VBE file written to the Startup folder. Some samples drop HTA files directly, while others drop obfuscated VBS or VBE downloader scripts that fetch and execute an HTA payload from a Cloudflare Tunnel (trycloudflare[.]com), adding an extra download stage before reaching the same HTA-to-VBScript execution flow. Each RAR archive contains one visible PDF and one hidden ADS entry traversing six directory levels.

At the login, mshta.exe automatically executes the HTA file. The HTA loads and runs VBScript from external resources hosted through Dynamic DNS and Cloudflare Workers infrastructure. This use of Cloudflare Workers as a C&C proxy is a characteristic pattern of recent Earth Dahu operations. The C&C delivers various espionage modules depending on the target. ClearSky Cyber Security has also reported a Wiper component delivered through this chain.

The C&C URLs embedded in these HTA files frequently use HTTP basic-auth @-notation to spoof trusted domains in the URL bar. For example, a URL structured as hxxps://ssu[.]gov[.]ua@malicious[.]workers[.]dev/path displays ssu.gov.ua to the left of the @ symbol, making the URL appear to originate from the Security Service of Ukraine, while the actual request is directed to the attacker-controlled workers[.]dev subdomain. Spoofed brands observed in the campaign include:

We observed a minor TTP evolution in newer samples: approximately half of the HTA-chain archives append an additional Startup\..\Startup\ sequence to the ADS traversal path. The final destination is the same, but the variation may be intended to evade detection rules matching the original traversal pattern. Both patterns coexisted in the latest campaign, suggesting the operator runs multiple build templates in parallel.

We obtained multiple spear-phishing emails associated with Earth Dahu's HTA campaign, spanning December 2025 to April 2026. The majority were sent from compromised accounts within Ukrainian government organizations and free email services. In one cluster, four separate accounts on a single regional government Exchange server shared the same internal originating IP, suggesting a compromised workstation distributing emails through multiple mailboxes. Additional compromised accounts were identified on justice and criminal-executive service systems.

One email was sent via astrocaf[.]com, an attacker-controlled domain registered through reg.ru on December 18, 2025, resolving to 194[.]58[.]66[.]82 (Baxet Group Inc., AS26383). The From header spoofed a Ukrainian law enforcement agency; DMARC validation failed and no DKIM signature was present. Two additional emails used vodafonenovic33@joymobile[.]com[.]ua as the Return-Path, routed through mail[.]c1[.]com[.]ua (5[.]9[.]241[.]27, Hetzner, Germany).

Most emails exhibit a self-addressed BCC pattern in which the From and To fields are identical, hiding the actual recipient list. Email subjects consistently impersonate Ukrainian judicial correspondence: court summons, writs of execution, and property seizure resolutions. All attachments follow the naming pattern {DocType}_{N}_{N}_{N}_{N}_{dd.mm.yyyy}.rar.

We track the binary payload chain (CVE-2025-8088 to LNK to PowerShell to result.dll ) under SHADOW-EARTH-066 , our temporary designation for the intrusion set that CERT-UA tracks as UAC-0226 .

The attribution to UAC-0226 is based on the malware lineage. Our analysis confirms that result.dll is a direct evolution of GIFTEDCROOK, the stealer that CERT-UA attributed to UAC-0226 in April 2025. The two the same compiler toolchain, cryptographic framework, anti-analysis checks, and exfiltration protocol, as detailed in the evolution comparison above.

Timestamp analysis provides an additional attribution data point. All LNK files the same creation timestamp and builder machine identifier (desktop-hagd25b), confirming a single build environment. The PE compile timestamps of four distinct DLL builds (February 3, February 17, March 16, and April 9, 2026) cluster between 06:33 and 11:32 UTC. RAR archive timestamps for the packaged decoy PDFs independently corroborate these build sessions, aligning within seconds of the corresponding PE compile times.

Mapped to UTC+3 (Moscow time), these correspond to 09:33–14:32 local time. All six build events fall on weekdays. While these timestamps can be manipulated, the consistent weekday pattern across multiple sources and the alignment with UTC+3 working hours suggest an operator based near that time zone.

We attribute the HTA-based infection chain to Earth Dahu (Gamaredon) with high confidence . This assessment is based on:

The two campaigns examined in this report the same initial exploit (CVE-2025-8088) and overlapping victimology, but the post-exploitation chains are fundamentally different:

The tooling reflects different development traditions: the GIFTEDCROOK family is a compiled C++ codebase with statically linked libcurl. Earth Dahu has historically favored script-based approaches.

Despite CVE-2025-8088 was patched in WinRAR 7.13 in July 2025, yet at the time of writing, multiple threat actor groups continued to build new exploit samples with fresh lure documents and use this vulnerability as a reliable initial access vector against Ukrainian organizations.

SHADOW-EARTH-066 uses it to deploy an evolved information stealer, while Earth Dahu uses it to deliver espionage tools. Russia-aligned threat actors, including Sandworm, Turla, and Void Rabisu, have also been reported exploiting the same vulnerability.

The convergence of both established state-backed groups and independently tracked clusters on a single vulnerability reflects the scale of the cyber threats that Ukraine faces. Since the full-scale invasion in 2022, the number of intrusion sets conducting operations against Ukrainian government and military networks has grown steadily, and credentials and documents stolen in these campaigns will not stay contained. Compromised accounts in military and government organizations may create downstream risks for allied nations and partners in their networks.

The vulnerability works because WinRAR remains unpatched on enough endpoints to make the investment worthwhile. WinRAR does not auto-update, does not support Group Policy, and falls outside enterprise patch channels like WSUS, SCCM, or Intune. Verifying patch status across hundreds of endpoints requires third-party tools or manual auditing.

SHADOW-EARTH-066 and Earth Dahu use different tooling and infrastructure, a compiled C++ stealer chain on one side, a script-based espionage framework on the other; but both relied on the same unpatched entry point.

This problem is not unique to WinRAR, to Ukraine, or to these threat actors. Many utility applications, archiving tools, and file viewers the same traits: widely installed, infrequently updated, and difficult to manage at enterprise scale. They accumulate known vulnerabilities over time, and threat actors deliberately look for them. CVE-2018-20250, a WinRAR vulnerability from 2018, was still being exploited in targeted attacks years after its disclosure. CVE-2025-8088 appears to be following the same pattern — and when threat actors find a vulnerability that works, they will keep using it until it stops working.

Tracking and patching these applications is not optional. It is a basic requirement for reducing the attack surface that threat actors rely on.

Emerging threats: Persistent Exploitation of WinRAR Vulnerability CVE-2025-8088 by SHADOW-EARTH-066 and Earth Dahu Against Ukraine

Threat actors: Earth Dahu , SHADOW-EARTH-066

Persistent Exploitation of WinRAR Vulnerability CVE-2025-8088 by SHADOW-EARTH-066 and Earth Dahu Against Ukraine

The indicators of compromise for this entry can be found here .