Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs
The ghost of a bug long buried is haunting Ukrainian systems, and it tells us far more about our broken security culture than about Russian hackers. At least two Moscow-aligned threat groups—Shadow-Earth-066 and the perennially persistent Earth Dahu (also known as Gamaredon, Shuckworm, and a half-dozen other aliases)—are actively exploiting CVE-2025-8088, a high-severity WinRAR flaw that was patched almost a full year ago. Their target: military and government organizations in Ukraine. Their met
Analysis
The ghost of a bug long buried is haunting Ukrainian systems, and it tells us far more about our broken security culture than about Russian hackers. At least two Moscow-aligned threat groups—Shadow-Earth-066 and the perennially persistent Earth Dahu (also known as Gamaredon, Shuckworm, and a half-dozen other aliases)—are actively exploiting CVE-2025-8088, a high-severity WinRAR flaw that was patched almost a full year ago. Their target: military and government organizations in Ukraine. Their method: weaponized emails, the oldest trick in the book, now turbocharged with a vulnerability everyone should have moved past.
This isn’t a story about sophisticated zero-days. It’s a far more damning tale about the chronic disease of software debt and the operational realities of digital warfare. For the attackers, a patched CVE is not a closed door; it’s a forgotten side entrance, and in the chaotic environment of a nation under sustained cyber siege, it’s an entrance that remains wide open. Trend Micro’s researchers noted that WinRAR is “deeply embedded in daily operations” across Ukrainian organizations. That phrase is the critical tell. It’s not about the flaw itself; it’s about the tool. WinRAR, a venerable workhorse of file compression, has become a piece of digital legacy infrastructure. It’s the kind of utility installed on a system a decade ago, used daily, and never given a second thought until it’s the hinge point for an espionage campaign.
The separate attack chains from the two groups are almost a case study in differentiated tradecraft. Shadow-Earth-066, tracked as UAC-0226, used the flaw to deploy an updated version of the GiftedCrook stealer. This is a blunt instrument: grab credentials and documents, then self-delete. It’s smash-and-grab intelligence gathering. Earth Dahu, meanwhile, opted for a more complex, layered infection via HTML applications, a method that suggests a longer-term, more patient espionage objective. Both groups are leveraging the same entry point, but their divergent paths highlight how a single point of systemic weakness—a neglected update—can fuel multiple, adaptable campaigns.
But here’s the judgment call: the real villains in this story are not just the APTs. It’s the collective complacency that allows a critical utility like WinRAR to remain unpatched in sensitive environments for a year. The update prompt for WinRAR is famously persistent, almost meme-worthy in its insistence. The fact that it can be, and is, ignored in military and government networks speaks to a profound dysfunction. It points to operational tempo overriding cybersecurity hygiene, to bureaucratic inertia, to the sheer, overwhelming burden of managing thousands of endpoints in a warzone where patches might break legacy tools needed for immediate tasks. The attackers know this. They don’t need to find new doors when the old ones are reliably unlocked.
This incident should shatter any lingering illusion that “patching” is a one-time event. It’s a continuous, exhausting process of maintenance. In the context of the ongoing cyber conflict with Russia, which has been raging since at least 2014 and escalated massively in 2022, these unpatched vulnerabilities are not accidents—they are a predictable and exploitable feature of the landscape. For threat actors like Gamaredon, which has been active for years under various monikers, patience is a weapon. They can wait for the inevitable slow adoption of updates.
What we’re witnessing is the brutal reality of cyberwarfare played out on a terrain littered with digital landmines that we ourselves failed to clear. The Russian groups are simply walking the well-worn paths. The Trend Micro report is less a warning about a new tactic and more a clinical diagnosis of a chronic condition: the defense gap between knowing a fix exists and actually deploying it across an entire national infrastructure under fire. Until that gap closes, the ghost of CVE-2025-8088—and the countless ghosts of future “patched” flaws—will keep marching through the networks, invited in by our own negligence. The exploit is old. The target is perennial. The failure is ours.
Disclaimer: The above content is generated by AI and is for reference only.