# Russia-aligned Gamaredon (Earth Dahu) and UAC-0226 (SHADOW-EARTH-066) Exploit Patched WinRAR Path-Traversal CVE-2025-8088 (NTFS ADS) Against Ukrainian Organizations

> Russia-aligned threat groups Gamaredon (Earth Dahu) and UAC-0226 (SHADOW-EARTH-066) continue exploiting CVE-2025-8088, a path-traversal flaw in WinRAR that abuses NTFS Alternate Data Streams to write files outside the extraction directory, nearly a year after WinRAR shipped a fix in July 2025. Spearphishing campaigns deliver crafted RAR archives that silently plant LNK persistence and loaders, deploying the GammaPhish/GammaLoad/GammaWorm/GammaSteel toolset and the GIFTEDCROOK stealer to harvest browser credentials and documents from Ukrainian government, military, and critical-infrastructure targets.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-10-20T20:25:19.550Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0723
- **ID:** TL-2026-0723
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Gamaredon and UAC-0226 (Russia)
- **Detections:** 9 · **IOCs:** 66 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-8088

## Description

CVE-2025-8088 is a directory/path-traversal vulnerability (CWE-35) in WinRAR's Windows components (WinRAR desktop app, UnRAR.dll, and portable UnRAR source) affecting versions prior to 7.13. The flaw abuses NTFS Alternate Data Streams (ADS): by embedding ADS entries whose names contain path-traversal sequences and the ADS colon separator, a specially crafted archive that appears to contain only a single benign file silently writes attacker-controlled files (DLLs, LNK shortcuts, scripts) to arbitrary locations such as %TEMP% and the per-user Startup folder during a normal extraction. Combined with a Startup-folder LNK, this yields code execution on next user logon. The vulnerability was originally discovered as a zero-day by ESET on 2025-07-18 while being exploited by the Russia-aligned RomCom group (Storm-0978) in spearphishing against financial, manufacturing, defense, and logistics organizations in Europe and Canada; WinRAR patched it in version 7.13 on 2025-07-30. NVD scores it 8.8 HIGH (CVSS 3.1).

Despite the patch, Russia-aligned groups have continued operationalizing CVE-2025-8088 against Ukraine well into 2026, exploiting the long tail of unpatched WinRAR installs in organizations where the tool is deeply embedded in daily operations. Trend Micro (researchers Hiroyuki Kakara and Feike Hacquebord) and Sekoia documented Gamaredon (tracked as Earth Dahu) incorporating the exploit from September 2025, and UAC-0226 (SHADOW-EARTH-066) using it to deliver an updated GIFTEDCROOK stealer. Sekoia's opportunistic YARA rule (deployed late December 2025) generated a dozen hits by January 2026, revealing a still-active campaign with multiple spearphishing waves against Ukrainian state institutions dating to September 2025.

The Gamaredon chain delivers a GammaPhish HTML Application (HTA) that drops a GammaLoad VBScript downloader leveraging Dead Drop Resolvers (DDR); GammaWorm establishes persistence and arbitrary code execution while GammaSteel performs comprehensive information theft with real-time file monitoring, exfiltrating data to AWS S3-compatible buckets. GammaWorm resolves live C2 nodes through DDR hosted on Telegraph/Teletype (graph.org), Cloudflare Workers subdomains, Supabase functions, trycloudflare tunnels, and public Telegram channels parsed with curl.exe. The UAC-0226/GIFTEDCROOK chain ships a decoy PDF plus three hidden ADS payloads, drops a Startup-folder LNK, spawns a PowerShell loader via cmd.exe, loads a DLL (result.dll) in memory to launch GIFTEDCROOK, and exfiltrates browser credentials/cookies and documents under 7MB modified in the last 45 days; exfiltration shifted from Telegram to dedicated C2 servers around February 2026 in alignment with Russia's blocking of Telegram. The original RomCom disclosure additionally tied CVE-2025-8088 to the Mythic agent, SnipBot variant, RustyClaw downloader, and MeltingClaw, with COM-hijacking persistence and sandbox-evasion guardrails.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1546 Event Triggered Execution
- T1053 Scheduled Task/Job
- T1564 Hide Artifacts
- T1497 Virtualization/Sandbox Evasion
- T1480 Execution Guardrails
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1518 Software Discovery
- T1087 Account Discovery
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1025 Data from Removable Media
- T1113 Screen Capture
- T1071 Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1620 Reflective Code Loading
- T1083 File and Directory Discovery
- T1485 Data Destruction
- T1106 Native API
- T1218.005 System Binary Proxy Execution
- T1539 Steal Web Session Cookie

## Sources

- [WinRAR Flaw Exploited by Russia-Aligned Groups (hunt source)](https://thehackernews.com/2026/06/winrar-flaw-exploited-by-russia-aligned.html)
- [Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine](https://thehackernews.com/2026/06/gamaredon-exploits-winrar-to-deliver.html)
- [FSB's matryoshka #1/3: Inside Gamaredon Cyber Operations — GammaPhish and GammaWorm](https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/)
- [Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability](https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/)
- [NVD — CVE-2025-8088](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)
- [WinRAR zero-day was exploited by two threat actors (CVE-2025-8088)](https://www.helpnetsecurity.com/2025/08/12/winrar-zero-day-cve-2025-8088-attacks/)
- [WinRAR Directory Traversal & NTFS ADS Vulnerabilities (CVE-2025-6218 & CVE-2025-8088)](https://www.seqrite.com/blog/winrar-directory-traversal-ntfs-ads-vulnerabilities-cve-2025-6218-cve-2025-8088/)
- [UAC-0226 Deploys GIFTEDCROOK Stealer via Malicious Excel Files Targeting Ukraine](https://thehackernews.com/2025/04/uac-0226-deploys-giftedcrook-stealer.html)
- [GIFTEDCROOK Malware Evolves: From Browser Stealer to Intelligence-Gathering Tool](https://thehackernews.com/2025/06/giftedcrook-malware-evolves-from.html)
- [UAC-0226 New Cyber-Espionage Campaign with GIFTEDCROOK Stealer (CERT-UA #14303)](https://socprime.com/blog/detect-uac-0226-attacks-against-ukraine/)
- [WinRAR CVE-2025-8088 explained: Directory traversal enables arbitrary file writes](https://www.threatlocker.com/blog/winrar-cve-2025-8088-explained-directory-traversal-vulnerability-enables-arbitrary-file-writes)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0723