UAC-0226 GIFTEDCROOK: WinRAR ADS Path Traversal LNK Drop to Startup

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•14

Detects the creation of shortcut (.lnk) files in the Windows Startup directory by common archive extraction utilities, indicative of the Gamaredon/UAC-0226 GIFTEDCROOK campaign using CVE-2025-8088 to perform path traversal and gain persistence.