Unpatched and end-of-support software on Windows endpoints exposes KEV-listed vulnerabilities (Acronis TRU telemetry; CVE-2023-38831, CVE-2026-59265)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5749 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WinRAR CVE-2023-38831 Archive Exploit Spawning Script Interpreter (Exploitation)

Detects WinRAR (CVE-2023-38831, fixed in 6.23) or Apache OpenOffice (CVE-2026-59265, through 4.1.16) spawning cmd, PowerShell, wscript, mshta, rundll32 or regsvr32. In the WinRAR exploit a user double-clicks a decoy file inside a crafted ZIP and a same-named folder runs a script from a Rar$DI temp directory, delivering DarkMe, GuLoader and Remcos RAT. Flags Rar$DI extraction paths. WinRAR is KEV-listed and still unpatched on 5.3% of Windows PCs per Acronis TRU.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1204.002, T1036.007
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(ParentImage="*\\WinRAR.exe" OR ParentImage="*\\soffice.bin" OR ParentImage="*\\soffice.exe")
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe")
| eval rar_extract_dir=if(like(CommandLine, "%Rar$DI%"), "yes", "no")
| fillnull value="n/a" User ParentCommandLine
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as child_commands values(ParentCommandLine) as parent_commands values(rar_extract_dir) as rar_extract_dir by host User ParentImage
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("WinRAR.exe", "soffice.bin", "soffice.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| extend RarExtractDir = ProcessCommandLine has "Rar$DI" or InitiatingProcessCommandLine has "Rar$DI"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RarExtractDir, SHA256
| order by Timestamp desc

Sigma

title: WinRAR or OpenOffice Spawning Script Interpreter (CVE-2023-38831 and CVE-2026-59265)
id: 3f1c7a52-6d0e-4b8a-9c21-5e7a0b4d1f01
status: experimental
description: Detects WinRAR launching a command shell or script host, the post-exploitation behaviour of CVE-2023-38831 where a benign looking file in a crafted archive triggers a same-named folder holding a script. Also covers Apache OpenOffice soffice spawning interpreters, matching CVE-2026-59265 Java integration code execution.
references:
  - https://www.acronis.com/en/tru/posts/every-pc-has-a-junk-drawer-and-attackers-know-it/
  - https://nvd.nist.gov/vuln/detail/CVE-2023-38831
  - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
  - https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.execution
  - attack.t1203
  - attack.t1204.002
  - cve.2023.38831
  - cve.2026.59265
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\WinRAR.exe'
      - '\soffice.bin'
      - '\soffice.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Administrators extracting archives that ship a legitimate installer script
  - OpenOffice macros that intentionally call cmd.exe
level: high

Known false positives:

• Admins or packaging staff extracting archives that legitimately include setup scripts run from WinRAR
• OpenOffice macros or extensions that intentionally invoke cmd.exe or PowerShell

Tuning notes: Exclude known software-deployment hosts and service accounts. Raise severity when CommandLine contains Rar$DI. Scope to WinRAR builds below 6.23 using software inventory if available.

• 🔒 CVE-2023-38831 Double Extension Script in WinRAR Rar$DI Extraction Path (Exploitation) · unlock with TL Creds
• 🔒 Rundll32 OCX Loading and ImagingDevices Sideload Host (Post-Exploitation) · unlock with TL Creds
• 🔒 TightVNC UltraVNC TeamViewer Execution from User Path or Script Parent (C2 Remote Access) · unlock with TL Creds
• 🔒 CVE-2023-38831 Campaign Known Malicious Sample Hash Execution (Exploitation) · unlock with TL Creds
• 🔒 PowerShell Browser Credential Store Theft IRONJAW Style (Post-Exploitation) · unlock with TL Creds
• 🔒 Webhook.site Fex.net Dropbox API Callback from Script Host or User Path Binary (C2) · unlock with TL Creds
• 🔒 DarkMe Run Key and ImagingDevices.exe Autostart Persistence (Post-Exploitation) · unlock with TL Creds
• 🔒 CVE-2023-38831 Campaign and Community Sibling C2 Infrastructure Contact (C2) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5749.

Sample indicators (3 of 26)

• IP address: 45.74.19[.]96
• Domain: corialopolova[.]com
• URL: hxxp://webhook[.]site/e2831741-d8c8-4971-9464-e52d34f9d611

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Technical analysis

Acronis TRU (author Alexander Ivanyuk, published 2026-11-11) analysed telemetry from more than 1.8 million business computers online on 2026-09-30. The average Windows PC carries 38 applications and 22.3% carry more than 50. 25.6% of Windows installs with a known install date are older than three years. Removed Windows apps had been installed 677 days on average, and 46.3% stayed more than a year. 22.8% of Windows PCs run at least one product its maker no longer supports, including Office 2016/2019 (9.8%, support ended 2025-10-14), Silverlight (5.4%), SQL Server 2008/2012/2014 engines (4%), Office 2007/2010/2013 (3%), Acrobat and Reader 9/X/XI (2.9%), Chrome 109 or older (1.9%), Flash Player (1.8%), Java 6 and 7 (1.2%), Shockwave Player (0.48%), QuickTime for Windows (0.25%) and Python 2 (0.03%).

Acronis defines a waiting update as an app security update that is new, failed or pending restart, fixes at least one known weakness, and has been available for more than 30 days (OS updates excluded). Update data exists for 41.5% of the Windows PCs studied; 22.1% of those have such an update waiting (9.2% of all Windows PCs). Of those PCs, 77% have an update that fixes a CISA-listed exploited weakness and 57.2% of those are tied to ransomware. Most-affected apps by share of PCs with update data: WinRAR 5.3% (99.6% with an exploited-weakness fix, oldest waiting update 2020), Java 4.9% (96.7%, oldest 2016), Firefox 4.5% (87.1%, oldest 2013), Notepad++ 4.0%, 7-Zip 3.8%, VLC 1.4%, Chrome 0.8%, Zoom 0.6%, Foxit Reader 0.4%, TeamViewer 0.3%, TightVNC 0.3% (all critical), Flash Player 0.2% and Thunderbird 0.2%. Cited CISA KEV entry counts are WinRAR 5, 7-Zip 1, Firefox 12, Java 13 and Acrobat/Reader 24. Median time to install a security update is 6 days across all apps but 35 days for WinRAR, 63 for UltraVNC, 71 for VLC and about 1,000 for Java.

Two CVEs are named. CVE-2023-38831 (RARLAB WinRAR before 6.23, CVSS 3.1 7.8, NVD CWE-345, CISA KEV added 2023-08-24) lets attackers run arbitrary code when a user opens a benign file inside a crafted ZIP archive, because a same-named folder is processed and can contain executable code. It was exploited in the wild from April 2023 by cybercriminals (Group-IB reported DarkMe, GuLoader and Remcos RAT delivered to traders via forums) and by state-backed actors (Google TAG: FROZENBARENTS/Sandworm, FROZENLAKE/APT28, ISLANDDREAMS/APT40). CVE-2026-59265 (Apache OpenOffice up to 4.1.16, published 2026-10-02, CVSS 3.1 8.8 secondary score, CWE-426) is a code-execution flaw in the Java integration triggered by opening a crafted untrusted document. CISA SSVC lists exploitation as none, and the fix is expected in 4.1.17, which is in release-candidate phase. The workaround is to disable Java runtime integration and avoid untrusted files.

The report also flags remote-control tools with waiting updates (TeamViewer 0.3%, TightVNC 0.3% all critical, UltraVNC 0.2% with 93% critical). It states that its findings describe exposure on computers, not confirmed breaches. The source gives no actor attribution, malware family or IOCs for this report itself; the IOCs below are historical indicators from primary research on CVE-2023-38831, included as pivot material for defenders. The overall severity is analyst-assigned (MEDIUM) because this is aggregate exposure telemetry, not a single exploit.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.007 Double File Extension; T1218.011 Rundll32

Execution

T1059.001 PowerShell; T1203 Exploitation for Client Execution; T1204.002 Malicious File

Command and Control

T1219 Remote Access Tools

Persistence

T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1555.003 Credentials from Web Browsers

Initial Access

T1566.001 Spearphishing Attachment

stealth

T1574.001 DLL

Remediation

Patches

• WinRAR 6.23 or later for CVE-2023-38831
• Apache OpenOffice 4.1.17 (expected, release candidate) for CVE-2026-59265

Immediate actions

• Inventory applications on every Windows PC and treat PCs without update data as findings
• Remove end-of-support products first: Silverlight, Flash Player, Shockwave Player, QuickTime, and old Office and Acrobat/Reader versions
• Update WinRAR to 6.23 or later (CVE-2023-38831) and apply waiting updates for Java, Firefox, 7-Zip, Notepad++ and Acrobat/Reader
• Prioritize updates that fix CISA KEV-listed weaknesses
• Remove remote-control tools (TeamViewer, TightVNC, UltraVNC) after use and patch those that remain

Workarounds

• Disable Java runtime integration in Apache OpenOffice Preferences (CVE-2026-59265)
• Avoid opening untrusted documents and archives

Longer-term hardening

• Enable third-party patching, not only scanning, on every managed PC
• Review approvals and maintenance windows so updates do not wait more than a few weeks
• Decide per customer whether to license, replace or remove Java (Oracle requires a paid subscription for business use of Java 8 updates)
• Replace PCs that cannot run a supported Windows version
• Repeat the app review every few months, including failed or pending updates, and run an annual cleanup of end-of-life software and installer leftovers

Affected and fixed versions

• RARLAB — WinRAR
  Vulnerable versions: before 6.23
  Fixed in: 6.23
• Apache Software Foundation — Apache OpenOffice
  Vulnerable versions: through 4.1.16
  Fixed in: 4.1.17 (expected)
• Various — Java, Firefox, 7-Zip, Notepad++, Adobe Acrobat/Reader (outdated installs with KEV-listed fixes waiting)
  Vulnerable versions: installs with security updates pending more than 30 days
  Fixed in: current vendor releases
• Various — End-of-support products: Office 2007-2019, Silverlight, Flash Player, Shockwave Player, QuickTime for Windows, Java 6/7, SQL Server 2008-2014, Python 2, Chrome 109 and older
  Vulnerable versions: all versions past end of support

Timeline

• 2023-04-17 Cybercriminals begin exploiting CVE-2023-38831 in the wild (Group-IB: since April 2023), delivering GuLoader via locked-ioc-9 from 2023-04-17 to 2023-07-18.
• 2023-08-02 RARLAB releases WinRAR 6.23, fixing CVE-2023-38831.
• 2023-08-23 NVD publishes CVE-2023-38831 and Group-IB publishes its report on exploitation against traders.
• 2023-08-24 CISA adds CVE-2023-38831 to the Known Exploited Vulnerabilities catalog with a 2023-09-14 due date.
• 2023-10-18 Google TAG reports state-backed exploitation of CVE-2023-38831 by FROZENBARENTS (Sandworm), FROZENLAKE (APT28) and ISLANDDREAMS (APT40).
• 2025-10-14 Support ends for Office 2016 and 2019, which run on 9.8% of Windows PCs in the Acronis dataset.
• 2026-09-30 Acronis TRU telemetry snapshot of 1.8M+ business computers used for the exposure analysis.
• 2026-10-02 CVE-2026-59265 (Apache OpenOffice up to 4.1.16, Java integration code execution) published; fix expected in 4.1.17.
• 2026-11-11 Acronis TRU publishes 'Every PC has a junk drawer, and attackers know it'.

Sources cited

• NVD: CVE-2023-38831 NVD (NIST) · Advisory · 2023-08-23
• NVD: CVE-2026-59265 NVD (NIST) · Advisory · 2026-10-02
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2023-08-24
• CERT-UA report on FROZENLAKE (APT28) WinRAR campaign CERT-UA · Advisory · 2023-09-04
• Apache OpenOffice security: oss-security disclosure for CVE-2026-59265 openwall.com · Advisory · 2026-10-02
• Every PC has a junk drawer, and attackers know it (Acronis TRU) acronis.com · Research · 2026-11-11
• Group-IB: CVE-2023-38831 WinRAR zero-day exploited against traders group-ib.com · Research · 2023-08-23
• Google TAG: Government-backed actors exploiting WinRAR vulnerability Google · Blog · 2023-10-18

More in vulnerability

• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
• CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)

Other reports on CVE-2023-38831

• Q2 2026 Vulnerability and Exploit Landscape: Exploited AI-platform flaws (OpenClaw CVE-2026-25253, Dify CVE-2026-41948, Open WebUI CVE-2026-45386), Exchange CVE-2026-45501, and Linux kernel page-cache LPE exploit wave (Copy Fail, Dirty Frag)
• Russia (GRU Unit 26165 / APT28) Runs Multi-Vector Surveillance, Intimidation, Sabotage and Cyber Espionage Campaign Against Europe's Ukraine Defence Supply Chain
• Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiled
• APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine & EU (2024-2026 New TTPs)

Previous and next in vulnerability

• Local Privilege Escalation in Iperius Backup 8.8.3 for Windows via Elevated GUI Native Dialogs (CVE-2026-112174) Previous report