CVE-2025-8088: WinRAR Zero-Day Used to Deploy RomCom Backdoors
ESET has identified spearphishing campaigns leveraging malicious RAR attachments to exploit CVE-2025-8088—a WinRAR zero-day vulnerability. This technique delivers RomCom backdoors, attributed to threat actor Storm-0978 (aka Tropical Scorpius / UNC2596).
Microsoft Sentinel (KQL)
