Gamaredon CVE-2025-8088 WinRAR Path Traversal Dropping HTA to Startup Folder

Ibrahim Saud@tektrix

•updated Jun 27, 2026•2•0•9

Detects the exploitation of the CVE-2025-8088 vulnerability in WinRAR, where a path traversal technique is used to extract malicious files directly into the Windows Startup folder. This pattern is associated with threat actors like Gamaredon to achieve persistence, typically by placing HTA downloaders that execute upon user logon.