Turla CVE-2025-8088 WinRAR Path Traversal STOCKSTAY MSI Drop

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

Detects the execution of msiexec.exe spawned by WinRAR or unrar processes, specifically targeting the installation of STOCKSTAY payloads. This activity is indicative of exploitation of the WinRAR path traversal vulnerability (CVE-2025-8088), where attackers extract malicious MSI files to unauthorized locations to bypass security controls and achieve code execution.