WinRAR CVE-2025-8088 Exploitation via Startup Folder Persistence

Flavios Meta@RedonTG

•updated Feb 19, 2026•6•0•71

Detects the exploitation of the WinRAR path traversal vulnerability (CVE-2025-8088) where a compression utility process creates script or shortcut files in the Windows Startup folder for persistence. This technique has been observed in use by the Amaranth-Dragon threat actor.