WinRAR Spawning Script Interpreters

Ethan Andrews@eandrews

•updated Jun 2, 2026•9•0•31

Detects WinRAR extracting and launching HTML applications (mshta.exe) or script interpreters (wscript.exe/cscript.exe). This behavior is indicative of the CVE-2025-8088 exploit chain used by Gamaredon to deploy GammaPhish and GammaLoad.