Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088

Active Exploitation of WinRAR Vulnerability CVE-2025-8088

Google has revealed that multiple threat actors, including nation-state adversaries and financially motivated groups, are exploiting a now-patched critical security flaw in RARLAB WinRAR to establish initial access and deploy a diverse array of payloads. The vulnerability, CVE-2025-8088, was patched by WinRAR version 7.13 released on July 30, 2025, but continues to be exploited by various threat actors.

Why This Matters

The consistent exploitation method, a path traversal flaw allowing files to be dropped into the Windows Startup folder for persistence, underscores a defensive gap in fundamental application security and user awareness. This vulnerability has been exploited by multiple threat actors, including nation-state adversaries and financially motivated groups, resulting in the deployment of various malware and backdoors, highlighting the need for improved security measures and user awareness.

Key Insights

• CVE-2025-8088 has a CVSS score of 8.8, indicating a high-severity vulnerability: Google Threat Intelligence Group, 2026
• The vulnerability is being exploited by various threat actors, including nation-state adversaries and financially motivated groups, to deploy malware and backdoors: ESET, 2025
• The exploitation method involves a path traversal flaw allowing files to be dropped into the Windows Startup folder for persistence: Google Threat Intelligence Group, 2026

Practical Applications

• Use Case: Google is tracking the threat cluster behind the deployment of Cuba Ransomware, which is also known to use RomCom RAT, under the moniker UNC2596, and has observed the exploitation of CVE-2025-8088 to deliver malware and backdoors.
• Pitfall: Failure to patch vulnerabilities in a timely manner can lead to exploitation by threat actors, resulting in significant financial and reputational damage, as seen in the case of CVE-2025-8088.

References:

• https://thehackernews.com/2026/01/google-warns-of-active-exploitation-of.html
• https://www.eset.com/us/about/newsroom/press-releases/eset-research-discovered-new-romcom-rat-malware-used-by-apt-group/