RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088 Zero-Day via ADS Path Traversal

RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088 (TL-2026-0090) is a critical-severity advanced persistent threat campaign scored CVSS 8.8, first published 2026-02-04. It is attributed to RomCom (Russia) with high confidence, references 1 CVE (CVE-2025-8088), maps to 23 MITRE ATT&CK techniques (T1021, T1027.013, T1033), and is covered by 9 detection rules and 29 indicators of compromise.

Key facts for TL-2026-0090

Threat ID
TL-2026-0090
Severity
CRITICAL
CVSS
8.8
Status
ACTIVE
Category
APT
First published
2026-02-04
Last reviewed
2026-02-04
Attribution
RomCom
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
Financial, Manufacturing, Defense, Logistics
Target regions
Europe, Canada
Detection rules
9
Indicators of compromise
29

CVE-2025-8088 is a high-severity WinRAR path traversal zero-day (CVSS 4.0: 8.8) exploited in the wild by Russian groups RomCom (Storm-0978/Tropical Scorpius/UNC2596) and Paper Werewolf (GOFFEE). Discovered by ESET on July 18, 2025, the vulnerability abuses Windows Alternate Data Streams (ADS) to traverse paths during archive extraction, silently deploying malware to %TEMP%, %LOCALAPPDATA%, and the Windows Startup directory. RomCom delivered SnipBot, RustyClaw/MeltingClaw, and Mythic agents via spearphishing with malicious RAR attachments targeting financial, manufacturing, defense, and logistics companies in Europe and Canada. Added to CISA KEV August 12, 2025. Patched in WinRAR 7.13 on July 30, 2025.

How RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088 works

CVE-2025-8088 is a path traversal vulnerability in WinRAR discovered by ESET researchers Anton Cherepanov, Peter Košinár, and Peter Strýček while investigating active exploitation by the Russian cybercrime group RomCom (also tracked as Storm-0978, Tropical Scorpius, UAT-5647, and UNC2596).

The vulnerability exploits Windows Alternate Data Streams (ADS) — a Windows NTFS feature that allows different representations of the same file path. Malicious RAR archives are crafted to appear to contain only benign files (CVs, job applications, recruitment documents), but include hidden ADS entries with parent directory traversal elements (..\) targeting critical system paths. When a victim extracts the archive with WinRAR, malicious DLLs are silently deployed to %TEMP% or %LOCALAPPDATA% and persistence LNK files are planted in the Windows Startup directory. Multiple ADS entries with increasing traversal depths ensure reliable exploitation across different extraction locations. Dummy ADS entries flood WinRAR's error dialogs to obscure the malicious paths from the user.

ESET documented three distinct execution chains used by RomCom:

1. **Mythic Agent Chain**: Malicious LNK (Updater.lnk) modifies registry to hijack COM object PSFactoryBuffer (CLSID {1299CF18-C4F5-4B6A-BB0F-2299F0398E27}), redirecting InprocServer32 to %TEMP%\msedge.dll. The DLL decrypts AES-encrypted shellcode and validates the target's domain name against a hardcoded value — confirming pre-operation reconnaissance. The shellcode is a Mythic agent using dynamichttp C2 profile communicating with srlaptop[.]com.

2. **SnipBot Variant Chain**: Malicious LNK (Display Settings.lnk) executes ApbxHelper.exe — a modified PuTTY CAC binary with invalid code-signing certificate. The binary uses its own filename as decryption key. Anti-analysis checks require at least 69 documents in RecentDocs registry (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\) before proceeding. Downloads next-stage shellcode from campanole[.]com.

3. **MeltingClaw Chain**: Malicious LNK (Settings.lnk) executes Complaint.exe — RustyClaw, a Rust-based downloader with a different invalid code-signing certificate. Downloads MeltingClaw payload from melamorri[.]com.

Targets included financial, manufacturing, defense, and logistics companies in Europe and Canada. Spearphishing emails used job application themes (CVs, recruitment dossiers) from seznam.cz and gmx.com/gmx.net email addresses.

Independently, Russian group Paper Werewolf (GOFFEE) also exploited CVE-2025-8088 alongside CVE-2025-6218 (a separate WinRAR vulnerability patched five weeks earlier), as documented by Russian security firm Bi.ZONE.

This marks at least RomCom's third zero-day exploitation: CVE-2023-36884 (Word, June 2023), CVE-2024-9680 chained with CVE-2024-49039 (Firefox/Windows, October 2024), and now CVE-2025-8088 (WinRAR, July 2025).

MITRE ATT&CK techniques used in TL-2026-0090

lateral-movement

T1021 Remote Services

defense-evasion

T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks

discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery; T1482 Domain Trust Discovery

execution

T1059.003 Windows Command Shell; T1106 Native API; T1204.002 Malicious File

command-and-control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer

collection

T1074.001 Local Data Staging

privilege-escalation

T1546.015 Component Object Model Hijacking

persistence

T1547.001 Registry Run Keys / Startup Folder; T1574.001 DLL

defense-impairment

T1553.002 Code Signing

credential-access

T1555 Credentials from Password Stores

initial-access

T1566.001 Spearphishing Attachment

exfiltration

T1567.002 Exfiltration to Cloud Storage

Remediation for RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088

Patches

  • WinRAR 7.13 — released July 30, 2025
  • WinRAR 7.13 beta 1 — released July 24, 2025 (initial fix)

Immediate actions

  • Update WinRAR to version 7.13 or later immediately — CISA KEV deadline was September 2, 2025
  • Block RAR attachments at email gateway or strip ADS from incoming archives
  • Hunt for LNK files in Startup directories not associated with known software
  • Check registry for PSFactoryBuffer COM hijack: HKCU\SOFTWARE\Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\InprocServer32
  • Block known C2 domains: srlaptop[.]com, campanole[.]com, melamorri[.]com

Workarounds

  • Use 7-Zip instead of WinRAR — not affected by CVE-2025-8088
  • Disable ADS extraction in enterprise WinRAR deployments
  • Strip ADS from RAR files at email gateway before endpoint delivery

Longer-term hardening

  • Deploy Software Restriction Policies (SRP) or IFEO for WinRAR exploitation mitigation
  • Enable Windows Defender Attack Surface Reduction rules for archive extraction
  • Monitor for DLL files appearing in %TEMP% and %LOCALAPPDATA% after archive extraction
  • Audit all software dependencies using UnRAR.dll for patched versions
  • Implement email attachment sandboxing for archive files

CVEs associated with RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088

CVE-2025-8088

Weaknesses (CWE) in RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088

CWE-35

Timeline of RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088

  • RomCom exploits CVE-2023-36884 via Microsoft Word zero-day — establishing pattern of zero-day acquisition and use. Source: Microsoft Security Blog
  • RomCom chains CVE-2024-9680 (Firefox UAF) with CVE-2024-49039 (Windows privilege escalation) — second zero-day chain. Source: https://www.welivesecurity.com/en/eset-research/romcom-exploits-firefox-and-windows-zero-days-in-the-wild/
  • CVE-2025-6218, separate WinRAR path traversal, disclosed by ZDI. Paper Werewolf (GOFFEE) exploited this alongside CVE-2025-8088. Source: ZDI-25-409
  • ESET detects active exploitation: malicious DLL (msedge.dll) in RAR archive with unusual ADS paths. Telemetry links to RomCom. Source: https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
  • RomCom spearphishing campaign July 18-21 targeting financial, manufacturing, defense, and logistics companies in Europe and Canada. CV/recruitment-themed RAR attachments from seznam.cz and gmx.com addresses. ESET reports no successful compromises. Source: ESET telemetry
  • ESET reports vulnerability to RARLAB. WinRAR 7.13 beta 1 released same day with fix. CVE-2025-8088 assigned. 6-day gap from detection to vendor notification. Source: ESET/NVD
  • RARLAB releases WinRAR 7.13 with full fix for CVE-2025-8088 ADS path traversal. All prior versions affected. 500 million installed base at risk. Source: https://www.win-rar.com/
  • ESET publishes detailed analysis of CVE-2025-8088 exploitation by RomCom. Three execution chains documented: Mythic agent (COM hijacking), SnipBot variant (PuTTY CAC sideloading), MeltingClaw (RustyClaw downloader). Bi.ZONE simultaneously reports Paper Werewolf exploitation. Source: ESET WeLiveSecurity / Bi.ZONE
  • CISA adds CVE-2025-8088 to Known Exploited Vulnerabilities catalog. Federal remediation deadline: September 2, 2025. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • As of 2026-05-29, WinRAR CVE-2025-8088 (patched 7.13, Jul 2025; CISA KEV) remains actively exploited as an n-day per Google/Mandiant's Jan 2026 report, with Russia- and China-nexus APTs plus commodity-RAT crews abusing unpatched fleets. RomCom is undisrupted, deploying Mythic via SocGholish against Ukraine-linked US firms (Dec 2025) on rotating infra.

Sources cited for RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088

Threats related to RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088

Detection coverage for TL-2026-0090

As of 2026-02-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0090 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats