Gamaredon - WinRAR ADS Startup folder Traversal (T1204.002)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•8

Detects exploitation of CVE-2025-8088, where WinRAR writes a nested .vbs payload directly to the Startup folder via NTFS ADS path traversal.