Full Report
A prominent hacking operation known as RomCom and a lesser-known group tracked as Paper Werewolf or Goffee each exploited a zero-day vulnerability in WinRAR software this summer, researchers said.
Analysis Summary
# Vulnerability: WinRAR Arbitrary Code Execution Zero-Day Exploited by Threat Actors
## CVE Details
- CVE ID: CVE-2025-8088
- CVSS Score: Not explicitly stated, but implied High due to RCE via archive opening.
- CWE: Likely related to Improper Input Validation or Archive Handling
## Affected Systems
- Products: WinRAR file-archiving software
- Versions: Vulnerable versions pre-patch on July 24th (specific affected versions not listed, but all versions prior to the fix are vulnerable).
- Configurations: Requires the user to open a malicious archive file.
## Vulnerability Description
CVE-2025-8088 is a zero-day vulnerability in WinRAR that allows an attacker to achieve **Arbitrary Code Execution (ACE)** on a victim’s system simply by having the victim open a specially crafted, malicious archive file. This flaw was actively exploited by the Russia-aligned threat group RomCom (Storm-0978) and independently by the group Paper Werewolf (Goffee).
## Exploitation
- Status: Exploited in the wild (by RomCom and Paper Werewolf).
- Complexity: Low (Requires user interaction via opening a malicious archive, often delivered via spearphishing).
- Attack Vector: Network (via email/phishing) leading to Local execution.
## Impact
- Confidentiality: High (Code execution allows malware deployment, information theft).
- Integrity: High (Ability to modify or execute arbitrary code).
- Availability: Potential High (Depending on the payload deployed, e.g., wiper or ransomware).
## Remediation
### Patches
- **CVE-2025-8088 Patch:** Released on July 24th. Users must update to the version released on or after this date.
### Workarounds
- Exercise extreme caution when opening archive files (.RAR, etc.) received from untrusted or unexpected sources, especially those delivered via spearphishing emails.
- Temporarily restrict the ability for users to open unsolicited archive files until patching is complete (if feasible).
## Detection
- **Indicators of Compromise (IOCs):** Monitoring for successful execution of unexpected processes following the opening of an archive file.
- **Detection Methods and Tools:** Network traffic analysis for suspicious connections originating from newly spawned processes following archive processing. EDR solutions should monitor for standard post-exploitation activity following perceived successful file extraction/opening events.
## References
- Vendor Advisories: Not explicitly listed (rely on ESET/BI.ZONE reports).
- Relevant Links:
- hxxps://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
- hxxps://bi.zone/expertise/blog/paper-werewolf-atakuet-rossiyu-s-ispolzovaniem-uyazvimosti-nulevogo-dnya-v-winrar/
---
***Note on Secondary Vulnerability:*** *The article also mentions **CVE-2025-6218** (fixed in June), another WinRAR bug that allows arbitrary code execution upon opening a file or visiting a compromised website, which was exploited alongside CVE-2025-8088 by Paper Werewolf.*