# RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088 Zero-Day via ADS Path Traversal

> CVE-2025-8088 is a high-severity WinRAR path traversal zero-day (CVSS 4.0: 8.8) exploited in the wild by Russian groups RomCom (Storm-0978/Tropical Scorpius/UNC2596) and Paper Werewolf (GOFFEE). Discovered by ESET on July 18, 2025, the vulnerability abuses Windows Alternate Data Streams (ADS) to traverse paths during archive extraction, silently deploying malware to %TEMP%, %LOCALAPPDATA%, and the Windows Startup directory. RomCom delivered SnipBot, RustyClaw/MeltingClaw, and Mythic agents via spearphishing with malicious RAR attachments targeting financial, manufacturing, defense, and logistics companies in Europe and Canada. Added to CISA KEV August 12, 2025. Patched in WinRAR 7.13 on July 30, 2025.

- **Published:** 2026-02-04T14:20:00Z
- **Last reviewed:** 2026-02-04T14:20:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0090
- **ID:** TL-2026-0090
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** RomCom (Russia)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-8088, CVE-2023-36884, CVE-2024-49039, CVE-2025-6218

## Description

CVE-2025-8088 is a path traversal vulnerability in WinRAR discovered by ESET researchers Anton Cherepanov, Peter Košinár, and Peter Strýček while investigating active exploitation by the Russian cybercrime group RomCom (also tracked as Storm-0978, Tropical Scorpius, UAT-5647, and UNC2596).

The vulnerability exploits Windows Alternate Data Streams (ADS) — a Windows NTFS feature that allows different representations of the same file path. Malicious RAR archives are crafted to appear to contain only benign files (CVs, job applications, recruitment documents), but include hidden ADS entries with parent directory traversal elements (..\) targeting critical system paths. When a victim extracts the archive with WinRAR, malicious DLLs are silently deployed to %TEMP% or %LOCALAPPDATA% and persistence LNK files are planted in the Windows Startup directory. Multiple ADS entries with increasing traversal depths ensure reliable exploitation across different extraction locations. Dummy ADS entries flood WinRAR's error dialogs to obscure the malicious paths from the user.

ESET documented three distinct execution chains used by RomCom:

1. **Mythic Agent Chain**: Malicious LNK (Updater.lnk) modifies registry to hijack COM object PSFactoryBuffer (CLSID {1299CF18-C4F5-4B6A-BB0F-2299F0398E27}), redirecting InprocServer32 to %TEMP%\msedge.dll. The DLL decrypts AES-encrypted shellcode and validates the target's domain name against a hardcoded value — confirming pre-operation reconnaissance. The shellcode is a Mythic agent using dynamichttp C2 profile communicating with srlaptop[.]com.

2. **SnipBot Variant Chain**: Malicious LNK (Display Settings.lnk) executes ApbxHelper.exe — a modified PuTTY CAC binary with invalid code-signing certificate. The binary uses its own filename as decryption key. Anti-analysis checks require at least 69 documents in RecentDocs registry (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\) before proceeding. Downloads next-stage shellcode from campanole[.]com.

3. **MeltingClaw Chain**: Malicious LNK (Settings.lnk) executes Complaint.exe — RustyClaw, a Rust-based downloader with a different invalid code-signing certificate. Downloads MeltingClaw payload from melamorri[.]com.

Targets included financial, manufacturing, defense, and logistics companies in Europe and Canada. Spearphishing emails used job application themes (CVs, recruitment dossiers) from seznam.cz and gmx.com/gmx.net email addresses.

Independently, Russian group Paper Werewolf (GOFFEE) also exploited CVE-2025-8088 alongside CVE-2025-6218 (a separate WinRAR vulnerability patched five weeks earlier), as documented by Russian security firm Bi.ZONE.

This marks at least RomCom's third zero-day exploitation: CVE-2023-36884 (Word, June 2023), CVE-2024-9680 chained with CVE-2024-49039 (Firefox/Windows, October 2024), and now CVE-2025-8088 (WinRAR, July 2025).

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1546.015 Component Object Model Hijacking
- T1574.001 DLL
- T1497.001 System Checks
- T1140 Deobfuscate/Decode Files or Information
- T1553.002 Code Signing
- T1036.005 Match Legitimate Resource Name or Location
- T1027.013 Encrypted/Encoded File
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1059.003 Windows Command Shell
- T1102.002 Bidirectional Communication
- T1567.002 Exfiltration to Cloud Storage
- T1555 Credentials from Password Stores
- T1074.001 Local Data Staging
- T1021 Remote Services
- T1070.004 File Deletion
- T1106 Native API
- T1482 Domain Trust Discovery

## Sources

- [ESET Research: RomCom and Others Exploiting WinRAR Zero-Day CVE-2025-8088](https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/)
- [Ars Technica: High-Severity WinRAR 0-Day Exploited for Weeks by 2 Groups](https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/)
- [NVD — CVE-2025-8088 RARLAB WinRAR Path Traversal Vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)
- [CISA KEV — CVE-2025-8088 (Due: September 2, 2025)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088)
- [WinRAR 7.13 Release Notes — CVE-2025-8088 Fix](https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5)
- [Vicarius: CVE-2025-8088 Detection Guide](https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day)
- [Vicarius: CVE-2025-8088 Mitigation via SRP and IFEO](https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo)
- [Palo Alto Unit 42: SnipBot RomCom Malware Variant Analysis](https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/)
- [Cisco Talos: UAT-5647 RomCom RustyClaw Downloader Analysis](https://blog.talosintelligence.com/uat-5647-romcom/)
- [Bi.ZONE: Paper Werewolf Exploiting CVE-2025-8088](https://bi.zone/expertise/blog/paper-werewolf-atakuet-rossiyu-s-ispolzovaniem-uyazvimosti-nulevogo-dnya-v-winrar/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0090