Ongoing attacks leveraging the high-severity WinRAR path traversal flaw, tracked as CVE-2025-6218, have prompted its inclusion in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities list, reports The Hacker News .
Federal civilian executive branch agencies have been ordered to remediate the security issue, which could facilitate code execution via malicious websites or files, by Dec. 30. Multiple threat operations were reported to have already abused the flaw in recent months. Hacking group GOFFEE, also known as Paper Werewolf, was noted by BI.ZONE to have harnessed the bug alongside the critical WinRAR path traversal weakness, tracked as CVE-2025-8088, to compromise Russian organizations.
Separate intrusions involving CVE-2025-6218 have also been launched by South Asian advanced persistent threat operation Bitter and Russian hacking group Gamaredon to facilitate the deployment of a C# trojan and the Pteranodon malware, respectively. Gamaredon was also found by ClearSky researchers to have used CVE-2025-8088 for illicit VBScript and GamaWiper payload delivery.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
