APT & Targeted Attacks Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open Two separate Russia-aligned campaigns are still exploiting the WinRAR flaw CVE-2025-8088 against Ukrainian organizations nearly a year after it was patched, showing how unmanaged software keeps an exploited entry point open long after the fix ships. By: Hiroyuki Kakara, Feike Hacquebord Jun 08, 2026 Read time: ( words) Save to Folio Key Findings CVE-2025-8088, a path traversal vulnerability in WinRAR patched in July 2025, is still being exploited by multiple intrusion sets targeting Ukraine, including an intrusion set we temporarily designated as SHADOW-EARTH-066 and Russia-aligned groups such as Earth Dahu (Gamaredon). At least until April 2026, both groups continued producing new exploit samples. Earth Dahu remains active at the time of writing. SHADOW-EARTH-066, tracked by CERT-UA as UAC-0226 since 2025, has deployed an updated version of its GIFTEDCROOK information stealer designed for rapid credential and document theft. The stealer harvests browser passwords, session cookies, and files matching 35 extensions. The threat actor shifted from basic Excel macros with plaintext Telegram exfiltration to WinRAR exploit chains, in-memory DLL loading via direct NT system calls, and encrypted command-and-control (C&C) infrastructure in under a year. WinRAR is not covered by Group Policy or centralized update mechanisms. Software with these characteristics tends to remain exploitable long after patches are released, creating a persistent blind spot in organizational vulnerability management. Introduction When Russia annexed Crimea in 2014, the Russia-aligned cyber threat landscape was defined by a handful of known actors: Pawn Storm (also known as APT28), Sandworm, Earth Koshchei (also known as APT29), Turla, and Earth Dahu (also known as Gamaredon). A decade later, those groups remain active, but they have been joined by a much larger number of distinct activity clusters targeting Ukraine. One pattern cuts across these clusters: the rapid adoption of vulnerabilities in widely used software. CVE-2025-8088 , the WinRAR vulnerability at the center of this report, was first reported in July 2025 as a zero-day used by Void Rabisu (ROMCOM) and has since been exploited by other groups, including Sandworm and Turla . SHADOW-EARTH-066 (known as UAC-0226) and Earth Dahu also exploited this vulnerability. WinRAR is deeply embedded in daily operations across Ukrainian organizations, making it an attractive target for exploitation. CVE-2025-8088 is a path traversal flaw (CVSS 8.4), patched in WinRAR 7.13 in July 2025, that allows an attacker to silently write files outside the extraction directory via NTFS Alternate Data Streams. Once the victim opens the archive, no further interaction is needed; they see only a decoy document. All the samples we analyzed exploit this vulnerability. In this report, we examine two separate campaigns that exploit CVE-2025-8088 against Ukrainian targets. The first is attributed to SHADOW-EARTH-066 and delivers an updated version of the GIFTEDCROOK information stealer that rapidly harvests credentials and documents before deleting itself. The second is attributed to Earth Dahu (Gamaredon) and delivers espionage tools through an HTA-based chain. The two groups use different tooling and infrastructure, but share the same entry point. The vulnerability: CVE-2025-8088 Victims receive a RAR archive, typically through email. When they open the archive with an older version of WinRAR, a PDF appears. That PDF can look like a court summons (see Figure 1), an administrative notice, or a defense ministry document. Nothing else is visible to the victim, but in the background, WinRAR has silently written additional files to locations outside the extraction directory, such as the Windows Startup folder. No dialog or warning appears. The next time the user logs in, the files execute. Figure 1. Example decoy document: A spoofed Ukrainian court summons accusing the target of "spreading false rumors" to create a sense of urgency and compel interaction download Both campaigns examined in this post used CVE-2025-8088, which is related to an earlier directory traversal vulnerability (CVE-2025-6218, patched in WinRAR 7.12) but exploits a different code path through NTFS Alternate Data Streams (ADS). ADS is a feature of the NTFS file system that allows additional named data streams to be attached to a file. Legitimate uses include metadata storage such as zone identifiers added by browsers, but ADS can also carry arbitrary data. RAR5 archives can include SERVICE headers (header type 0x03) with the STMz marker to represent ADS metadata. WinRAR before version 7.13 did not sanitize directory traversal sequences in these ADS names, allowing an attacker to embed ..\..\ sequences in the STMz entries and write files to arbitrary locations. Figure 2 illustrates this mechanism. Figure 2. How CVE-2025-8088 works: a RAR5 archive contains a visible decoy file and hidden ADS entries with path traversal sequences. SHADOW-EARTH-066: from GIFTEDCROOK campaign to a WinRAR exploit chain Background SHADOW-EARTH-066 is our temporary designation for the threat actor cluster tracked by CERT-UA as UAC-0226 , whose activities were first documented in CERT-UA advisory #14303 in April 2025. The campaign has targeted Ukrainian military innovation centers, military formations, law enforcement agencies, and local self-government bodies near Ukraine's eastern border since at least February 2025. The original campaign used spear phishing emails with macro-enabled Excel files (.xlsm) that referenced demining, administrative fines, UAV production, and compensation for destroyed property. The payloads, stored as base64-encoded strings in Excel cells, included a .NET reverse shell and a C/C++ credential stealer that CERT-UA named GIFTEDCROOK . The first version was a standalone executable that stole browser credentials from Chrome, Edge, and Firefox, archived them with PowerShell's Compress-Archive, and exfiltrated the archive to a Telegram channel. The bot tokens and chat IDs were hardcoded in plaintext. By February 2026, SHADOW-EARTH-066 had shifted from Excel macro droppers to CVE-2025-8088 as its initial access vector, and from embedded .NET payloads with Telegram exfiltration to an in-memory DLL loading chain with dedicated C&C servers. Inside the CVE-2025-8088 attack chain The most recent build artifact, dated April 9, 2026, indicates the campaign remained active through at least early April (the full attack chain is shown in Figure 3). The crafted RAR archives contain a visible decoy PDF alongside three hidden ADS payloads that use path traversal to write files outside the extraction directory: 5 levels up : An LNK shortcut file targeting %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ 12 levels up : A PowerShell loader script dropped to C:\ProgramData\ 12 levels up : An encoded DLL payload dropped to C:\ProgramData\ Figure 3. SHADOW-EARTH-066 attack chain from CVE-2025-8088 exploitation to HTTPS exfiltration. These traversal depths are calculated to reach the user's AppData directory tree from a typical email client with a temporary extraction path. The LNK is placed in the Startup folder so that it executes on the next login, triggering the payload chain. Twelve levels overshoot to the drive root, reaching C:\ProgramData\. From the victim's perspective, they extract the archive and see a PDF document. No warning is displayed, as the additional files are written silently in the background. We analyzed multiple RAR samples across several distinct build groups. While file names, encoding keys, and C&C addresses differ between builds, all share structural fingerprints: the DLL export name result.dll with a single Func export, the non-standard PE offset e_lfanew = 0x110, statically linked libcurl 8.14.0-DEV, identical RC4 exfiltration keys, and the same builder machine SID embedded in all LNK files. One sample (SHA256: 3d371ef71e40c34a75c168d4647db096c2f386499d99a88d4e16b63cd4acda25) is examined below. This RAR archive drops a court summons PDF from the Dnipropetrovsk Regional Administrative Court as a decoy (as seen in Figure 2). The three hidden ADS payloads are: an LNK file (bfF3BxteabXqg.lnk) to the Startup folder a PowerShell loader (KKN) to C:\ProgramData\ a SUB-encoded DLL (ND8, key 0x38) to C:\ProgramData\. Other samples use different decoy themes, including a Ministry of Defense registry of military obliges and military equipment manifests for KrAZ truck fleets. How the chain is executed When the victim next logs in, Windows executes the LNK file from the Startup folder. The LNK target is cmd.exe with arguments that launch a double-nested PowerShell session: cmd.exe /c start /min "" powershell -NoPr -Win Hidd -Ex Bypass -Com "powershell -NoPr -Ex Bypass -Com ""iex (gc 'C:\ProgramData\KKN' -raw)""" The outer powershell.exe spawns an inner powershell.exe . Both use -ExecutionPolicy Bypass to circumvent script execution restrictions and -WindowStyle Hidden to suppress visible windows. The inner session reads the loader script from C:\ProgramData\ and executes it via Invoke-Expression. Each build uses a different alias for Get-Content (gc, cat, or type), varying the command-line signature without changing functionality. The PowerShell loaders are heavily obfuscated scripts (65 to 74 KB). Functions are named with random English words joined by underscores (e.g., flexibility_denominator_wiretap(), polliwog_scenery_reward_plane_preset()). Hundreds of junk comment lines and Sleep calls with fractional values (e.g., Sleep 1.453) inflate the script and extend execution time to evade sandbox analysis (Figure 4). Figure 4. Excerpt from the obfuscated PowerShell loader (KKN): random-word function names, junk comments, and Sleep-based anti-sandbox calls. download Beneath the obfuscation, the loader performs in-memory DLL loading using dire