EXPLOIT RAR CVE 2025 8088 RomCom

Darya Fleishman@ShadoWalker

•updated Aug 11, 2025•2•2•31

Detects specially crafted RAR archives that exploit the CVE-2025-8088 directory traversal vulnerability. This technique is used to drop files into the Windows Startup folder for persistence, as seen in campaigns by the RomCom threat actor.