Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine

Gamaredon, a Russian hacking group, is leveraging a known WinRAR vulnerability, CVE-2025-8088, to deliver GammaWorm and GammaSteel malware to Ukrainian targets. This path traversal flaw allows attackers to execute arbitrary code, which is used to launch an HTML Application payload dubbed GammaPhish. The GammaPhish payload retrieves additional malicious components, facilitating data theft and propagation. The exploitation of CVE-2025-8088 is a significant concern, as it enables attackers to bypass security controls and gain unauthorized access to sensitive information¹. The active discussion surrounding this vulnerability, particularly in the context of Russian exploitation, underscores the need for prompt patching or close monitoring. So what matters to practitioners is that the exploitation status of CVE-2025-8088 dictates whether this is a patch-now or monitor situation, emphasizing the importance of staying vigilant and taking proactive measures to mitigate potential threats.