Russia-Aligned Groups Exploit Unpatched WinRAR Flaw in Campaigns Against Ukraine

Jun 8, 2026 · Original article ↗

Summary

Two Russia-aligned campaigns continued exploiting WinRAR CVE-2025-8088 against Ukrainian organizations through April 2026, delivering an evolved information stealer or espionage tools. The report details their techniques and recommends patching WinRAR and hunting for IО

Key points

CVE-2025-8088 is a path traversal flaw patched in WinRAR 7.13; opening a malicious archive with an older version can silently place files outside the extraction folder, including in the Startup folder.
SHADOW-EARTH-066, tracked by CERT-UA as UAC-0226, uses the flaw to load an evolved GIFTEDCROOK stealer that targets browser passwords, session cookies, and files matching 35 extensions.
The stealer uses in-memory DLL loading, encrypted HTTPS exfiltration to dedicated command-and-control servers, anti-analysis techniques, and self-deletion after running.
Earth Dahu (Gamaredon) uses a separate HTA/VBScript chain to deliver espionage tools, with some samples using Cloudflare infrastructure and compromised Ukrainian accounts for spear-phishing.
Both groups continued producing samples through April 2026; the report says Earth Dahu remained active at publication time.
Trend Micro recommends updating WinRAR across endpoints, hunting for campaign indicators, blocking command-and-control infrastructure, and rotating credentials and invalidating sessions after suspected compromise.

Article Details

Attack Vectors: Both campaigns used CVE-2025-8088 in crafted RAR archives opened with vulnerable versions of WinRAR to write files outside the extraction directory through NTFS Alternate Data Streams.
SHADOW-EARTH-066 used a Startup-folder LNK to launch a hidden PowerShell loader and load the GIFTEDCROOK payload in memory.
Earth Dahu used spear-phishing emails and RAR archives to place HTA, VBS, or VBE files in the Startup folder; some downloader scripts fetched HTA payloads through Cloudflare Tunnel infrastructure.
The campaigns used decoy documents themed as Ukrainian court, government, or military correspondence.
Defensive Notes: Verify WinRAR versions across endpoints and deploy a patched version; the article identifies WinRAR 7.13 as the version patched for CVE-2025-8088.
Inspect RAR5 SERVICE headers and STMz entries for ADS path traversal, and block or quarantine RAR attachments where feasible.
Hunt for randomized LNK or HTA files in the Startup folder, short-named files in C:\ProgramData\, and connections to the listed SHADOW-EARTH-066 C2 addresses.
Monitor for cmd.exe launching hidden PowerShell with execution-policy bypass, PowerShell allocating executable memory, and mshta.exe running from the Startup folder.
Use kernel-level telemetry to detect direct NT system calls used for executable-memory allocation and in-memory DLL loading.
For suspected compromises, reset affected passwords, invalidate active web sessions, rotate stored tokens and API keys, and enable MFA on critical accounts.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`astrocaf[.]com`	Attacker-controlled domain used to send a spear-phishing email.
DOMAIN	`mail[.]c1[.]com[.]ua`	Mail infrastructure used to route emails associated with the Earth Dahu spear-phishing campaign.
EMAIL	`vodafonenovic33@joymobile[.]com[.]ua`	Return-Path address used in two emails associated with the Earth Dahu spear-phishing campaign.
IPV4	`136[.]0[.]141[.]112`	SHADOW-EARTH-066 C2 infrastructure pivoted via a self-signed TLS certificate; direct communication was not observed.
IPV4	`136[.]0[.]141[.]138`	SHADOW-EARTH-066 C2 server; listed as an address used for HTTPS exfiltration.
IPV4	`136[.]0[.]141[.]41`	SHADOW-EARTH-066 C2 server; listed as an address used for HTTPS exfiltration.
IPV4	`166[.]0[.]132[.]237`	SHADOW-EARTH-066 C2 server; listed as an address used for HTTPS exfiltration.
IPV4	`194[.]58[.]66[.]82`	Resolution address for the attacker-controlled astrocaf[.]com domain used in a spear-phishing email.
IPV4	`23[.]26[.]237[.]80`	SHADOW-EARTH-066 C2 infrastructure pivoted via a self-signed TLS certificate; direct communication was not observed.
IPV4	`38[.]225[.]209[.]122`	SHADOW-EARTH-066 C2 infrastructure pivoted via a self-signed TLS certificate; direct communication was not observed.
IPV4	`38[.]225[.]209[.]229`	SHADOW-EARTH-066 C2 server; listed as an address used for HTTPS exfiltration.
IPV4	`5[.]9[.]241[.]27`	Mail-server address used to route emails associated with the Earth Dahu spear-phishing campaign.
SHA256	`3d371ef71e40c34a75c168d4647db096c2f386499d99a88d4e16b63cd4acda25`	SHA-256 of a RAR sample containing the SHADOW-EARTH-066 exploit chain.