Executive Summary
Two separate Russia-aligned cyber campaigns, identified as Earth Dahu (Gamaredon) and SHADOW-EARTH-066 (UAC-0226), are actively exploiting a known WinRAR path traversal vulnerability, CVE-2025-8088. Despite a patch being available since July 2025, the lack of automated update mechanisms for WinRAR has allowed these actors to maintain a persistent entry point into Ukrainian government and military organizations.
The technical execution involves using NTFS Alternate Data Streams (ADS) to silently write malicious files outside of the extraction directory when a user opens a crafted RAR archive. SHADOW-EARTH-066 utilizes this method to deploy an evolved variant of the GIFTEDCROOK information stealer, while Earth Dahu delivers script-based espionage tools and wipers via HTA and VBScript chains.
This activity highlights the significant risk posed by unmanaged utility software. The campaigns demonstrate a strategic pivot toward more sophisticated evasion techniques, including in-memory DLL loading via direct NT system calls and the use of Cloudflare Workers as C2 proxies to mask malicious infrastructure.
Key Details
Threat Name
CVE-2025-8088 WinRAR Exploitation
Affects
WinRAR versions prior to 7.13, WinRAR versions prior to 7.12, WinRAR, WinRAR < 7.13
Adversary
Earth Dahu Other Adversaries and Aliases: SHADOW-EARTH-066; Void Rabisu; Sandworm; Turla; Pawn Storm; Earth Koshchei; APT SHADOW-EARTH-066
MITRE Techniques
Malware/Tools
GIFTEDCROOK, GammaSteel, ROMCOM, PlugX, Charon Ransomware