Turla CVE-2025-8088 WinRAR Path Traversal Dropping STOCKSTAY via RAR Archive

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

Detects path traversal exploitation of WinRAR (CVE-2025-8088) where a malicious RAR archive extraction results in the creation of suspicious STOCKSTAY payload files (e.g., MicrosoftUpdateOneDrive.exe) outside of the expected or secure extraction directories, linked to Turla activity.