Gamaredon CVE-2025-8088 WinRAR Startup Folder Drop via Path Traversal

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects the creation of executable or script files within the Windows Startup folder where the parent process is WinRAR.exe. This activity is a common indicator of an adversary leveraging a self-extracting archive or malicious file extraction to achieve persistence by placing a payload in the user's startup directory.