Google warns to update WinRAR urgently because of vulnerability

Google warns to update WinRAR urgently because it has found a serious vulnerability heavily exploited by hackers.

Compression software to minimize files or make them easy to transfer. Many users may be very familiar with WinRAR as a free-to-use software, almost any software. Yet, this software is often subject to security vulnerabilities, such as this news.

According to a report by Google Cloud's official website, it discusses how the Google Threat Intelligence Group (GTIG) research team, a research team focused on cybersecurity research, detected an implementation of a security vulnerability on WinRAR software coded CVE-2025-8088, a vulnerability with a CVSS Score danger score of up to 8.4, a vulnerability by a global group of hackers, especially hackers sponsored by the Chinese and Russian governments, to release malware into the victim's machine.

This vulnerability is a Path Traversal vulnerability within WinRAR. With the use of Alternate Data Streams (ADS), hackers use RAR compressed files whose scripts guide the file to be loosened to a defined folder, usually a system-related folder (System). On the job side, it starts with hackers sending RAR compressed files that inside contain decoy documents, such as PDF genus documents, as decoys, where inside the compressed file contains a decoy file that contains a decoy file that does not contain a function (Dummy). And the payload files are stuffed together with an ADS script that allows a security-vulnerable version of WinRAR to unpack files to a defined folder, usually an important system folder such as Startup.

The script to use the ADS system to change the target of loosening the file usually starts by specifying the name of the file that needs to be loosened to a given folder, such as innocuous .pdf: malicious.lnk, in conjunction with a destination, such as

.. /.. /.. /.. /.. / Users / AppData / Roaming / Microsoft / Windows / Start Menu / Programs / Startup / malicious.lnk

That result would also lead to the loosening of the malicious.lnk file, a file of malware, into the destination folder that was ultimately defined.

According to the source, many hackers from around the world have exploited the vulnerability to spread malware varieties. Because of the many cases of hacking in this way, it is briefly considered that the hackers that have implemented the vulnerability are as follows:

UNC4895 (CIGAR), from Russia, used this vulnerability to attack targets in Ukraine by using Spearhead Phishing to release NESTPACKER malware.

APT44 (FROZENBARENTS) used the vulnerability to attack targets in Ukraine, likewise to release .LNK files that would lead to further downloads of malware.

An anonymous group of hackers from China used to release POISONIVY malware through .Bat genus files that were placed into the Startup folder from this vulnerability.

A group of hackers from Indonesia used this vulnerability to paste a .CMD file into the Startup folder, which leads to the download of a password-protected RAR compression file from the Dropbox file deposit service, which contains malware type, system back door or backdoor.

Hackers in Latin America use fake hotel reservation emails to trick them into downloading malware files, which leads to remote access Trojan malware installations such as XWorm and AsyncRAT into the victim's system, focusing their attacks on the travel and hospitality industry.

Outside of that, the vulnerability has also been exploited, advertised by an underground hacker group "zeroplayer," based on the black market of hackers to sell tools for implementing the vulnerability (Exploit).

# Trending # lemon 8 diary # Drug sign with lemon8 # google # Rar