On January 28, 2026, Google Threat Intelligence Group (GTIG) published an advisory documenting active exploitation of the path traversal vulnerability CVE-2025-8088 in WinRAR for Windows, despite patch 7.13 being available since July 30, 2025. The convergence of Russian state actors, Chinese state actors, and financially motivated groups on a flaw fixed six months earlier serves as a case study in the systemic failure of patch management across enterprise and consumer environments.
- ESET observed RomCom exploiting CVE-2025-8088 as a zero-day starting July 18, 2025, two weeks before the release of WinRAR 7.13.
- Google Threat Intelligence Group confirms active exploitation by Sandworm/APT44, Gamaredon/CARPATHIAN, Turla/SUMMIT, an unspecified Chinese actor, and financially motivated groups including a Brazilian cluster.
- The technical mechanism exploits path traversal with a payload hidden in Alternate Data Streams (ADS) of decoy files, with automatic drop into the Windows Startup folder for persistence and execution at login.
- CISA added CVE-2025-8088 to the Known Exploited Vulnerabilities Catalog on August 12, 2025, with two due dates of September 2, 2025, for U.S. federal agencies.
The Mechanism: How a RAR Archive Compromises the System
CVE-2025-8088 is classified as CWE-35 Path Traversal with a CVSS 3.1 score of 8.8 (HIGH) according to the official NVD record. The vulnerability allows a malicious RAR archive to extract files to arbitrary directories on the Windows operating system, bypassing the archiver's path normalization controls.
The payload observed by GTIG structures in two stages. The malicious file, typically an LNK, hides in Alternate Data Streams (ADS) of seemingly innocuous decoy files. When the user opens the archive — user interaction is required, as confirmed by the UI:R vector in CVSS — the path traversal enables extraction to ../../../../../../Users/[username]/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup. At the next login, Windows automatically executes the payload, ensuring persistence without further user action.
This chain makes the attack particularly insidious: a single file open, routine behavior in many workflows, yields persistent compromise. The ADS technique adds a layer of concealment, as the primary payload remains invisible to standard file listing operations.
"The consistent exploitation method, a path traversal flaw allowing files to be dropped into the Windows Startup folder for persistence, underscores a defensive gap in fundamental application security and user awareness" — Google Threat Intelligence Group, via The Hacker News
Who Is Attacking: The GTIG Threat Actor Map
GTIG explicitly identifies five threat clusters active on CVE-2025-8088. Russian state groups comprise Sandworm (APT44/FROZENBARENTS), known for cyber sabotage operations; Gamaredon (CARPATHIAN), specializing in intelligence collection in Ukraine and the post-Soviet space; and Turla (SUMMIT), a long-standing actor with a European focus. An unspecified Chinese actor rounds out the state-sponsored front.
Associated payloads reflect operational specialization. RomCom deploys SnipBot/NESTPACKER; Turla employs STOCKSTAY; the Chinese actor uses Poison Ivy with a specific technique: a batch script in the Startup folder that downloads a dropper. Financially motivated and criminal clusters employ AsyncRAT, XWorm, and Telegram bot backdoors. A Brazilian group is observed with a malicious Chrome extension for banking phishing, indicating reuse of the WinRAR vector against Latin American financial targets.
The temporal overlap is significant: ESET documented RomCom on the zero-day starting July 18, 2025. The pre-patch exposure window, followed by six months of post-patch exploitation, suggests the vulnerability has become a standardized vector, not an opportunistic one-off.
Commoditization: 'Zeroplayer' and the Exploit Economy
Alongside APT operations, GTIG tracks activity by 'zeroplayer,' an underground economy actor who advertised WinRAR exploits for "thousands of dollars" in the weeks preceding public disclosure. This timeline — commercialization before the patch, massive exploitation after — indicates a commoditization cycle that lowers the technical barrier for lesser threat operators.
The GTIG quote is explicit: "Zeroplayer's continued activity as an upstream supplier of highlights the continued commoditization of the attack lifecycle." The availability of ready-to-use exploits enables financially motivated groups without internal development capabilities to operate alongside state-sponsored APTs on the same technical vector.
The dossier does not specify the exact exploit price nor confirm that 'zeroplayer' is directly linked to any of the identified state actors. The infrastructural link between the underground supplier and operators remains undocumented at this time.
Immediate Actions
User interaction as a prerequisite for the attack makes operational measures immediately identifiable. The absolute priority is updating to WinRAR 7.13 or later, the version that remediates the vulnerability per the NVD record and GTIG reporting. Deployment must cover both enterprise endpoints and consumer installations, given the software's ubiquity.
The CISA KEV listing with two due dates of September 2, 2025, mandates timely remediation for organizations subject to BOD 22-01, but the response logic extends to all Windows environments. Monitoring the Windows Startup folder and user startup jobs serves as a complementary control to detect already-established persistence.
The main operational limitation stems from unquantified data: GTIG provides no victim count, global patch adoption percentage, or preferred targeting sectors beyond the Ukraine-Brazil geographic reference. These gaps prevent scoped risk estimates: priority must be calibrated based on one's own exposure to legacy WinRAR and the capacity for compressed patch deployment timelines.
A second WinRAR vulnerability, CVE-2025-6218 with CVSS 7.8, is reported by GTIG as exploited by GOFFEE, Bitter, and Gamaredon. This multi-CVE pattern on the same product reinforces the assessment of WinRAR as a standardized persistence vector across the threat landscape.
Why This N-Day Won't Die
The paradox of CVE-2025-8088 lies in its technical banality: it is not a sophisticated exploit requiring complex chains, but a ../.. sequence that software installed on millions of endpoints fails to neutralize. Persistence via the Startup folder is a years-documented technique whose success depends on the discrepancy between patch availability and patch application.
The convergence of Sandworm and a Brazilian criminal group on the same vector indicates the barrier is no longer geopolitical or capability-based, but purely operational: who has access to the exploit, who has targets running unpatched WinRAR, who has sufficient social engineering margins to get an archive opened. In this sense, CVE-2025-8088 functions as a technical equalizer between advanced and opportunistic threats.
The GTIG dossier, for all its evidentiary solidity, leaves the core problem open: without patch adoption metrics, without visibility into the residual attack surface, the defensive community operates against a dimensional blind spot. The January 28, 2026 alert is not a zero-day story: it is confirmation that an n-day can be more dangerous than its pre-patch incarnation, because awareness of its existence does not translate into remediation.
Sources
- https://thehackernews.com/2026/01/google-warns-of-active-exploitation-of.html
- https://nvd.nist.gov/vuln/detail/cve-2025-8088
- https://nvd.nist.gov/vuln/categories
- https://nvd.nist.gov/vuln/data-feeds
- https://nvd.nist.gov/vuln/vendor-comments
Information verified against cited sources and current as of publication.