A recently patched security flaw in WinRAR, identified as CVE-2025-8088, was weaponized as a zero-day exploit in phishing campaigns to deliver the RomCom malware, security researchers revealed.
The vulnerability, a directory traversal bug, was addressed in WinRAR version 7.13. It enabled attackers to craft malicious archives that could extract files into arbitrary file paths defined by the attacker rather than those selected by the user.
According to the WinRAR 7.13 changelog: "When extracting a file, previous versions of WinRAR, Windows versions of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked into using a path, defined in a specially crafted archive, instead of user specified path."
It further clarified that "Unix versions of RAR, UnRAR, portable UnRAR source code and UnRAR library, also as RAR for Android, are not affected."
By exploiting this flaw, attackers could place executables in Windows autorun directories, such as:
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup (user-specific)
- %ProgramData%\Microsoft\Windows\Start Menu\Programs\StartUp (system-wide)
This ensured that the malicious files would automatically run on the next reboot, giving attackers remote code execution capabilities.
Since WinRAR lacks an auto-update mechanism, users are urged to manually download the latest version from win-rar.com to protect themselves against this vulnerability.
The vulnerability was uncovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET. Strýček confirmed to BleepingComputer that the bug was actively exploited: "ESET has observed spearphishing emails with attachments containing RAR files," he said.
These malicious archives were used to deploy RomCom backdoors. Also known as Storm-0978, Tropical Scorpius, or UNC2596, RomCom is a Russia-linked cybercrime group tied to ransomware, credential theft, and extortion operations.
The group has a track record of leveraging zero-day exploits and developing custom malware to maintain persistence, steal sensitive data, and conduct espionage operations. RomCom has also been associated with ransomware families such as Cuba and Industrial Spy.
ESET confirmed that a detailed report on the exploitation of this flaw will be released in the coming weeks.