Gamaredon WinRAR ADS Startup Persistence

nomit vyas@xoxo

•updated Jun 25, 2026•3•1•14

Detects WinRAR creating a malicious VBS/VBE script within the Windows Startup folder using NTFS Alternate Data Streams, a behavior associated with the exploitation of CVE-2025-8088 by the Gamaredon threat group.