Two Russia-aligned campaigns are still exploiting CVE-2025-8088 in WinRAR against Ukrainian organizations long after the patch, using decoy archives to silently drop payloads and steal data. SHADOW-EARTH-066 delivers the evolved GIFTEDCROOK stealer while Earth Dahu uses an HTA-based espionage chain, underscoring how unmanaged software keeps the same entry point open. #CVE-2025-8088 #WinRAR #GIFTEDCROOK #SHADOW-EARTH-066 #EarthDahu #Gamaredon
Keypoints
- CVE-2025-8088 is a WinRAR path traversal flaw patched in July 2025, but it continued to be exploited through at least April 2026.
- SHADOW-EARTH-066 (tracked by CERT-UA as UAC-0226) used the flaw to deploy an updated GIFTEDCROOK stealer that quickly steals credentials and documents.
- Earth Dahu (Gamaredon) also exploited the flaw, but used an HTA/VBScript-based espionage chain rather than a compiled stealer chain.
- The WinRAR exploit abuses NTFS Alternate Data Streams to silently write files outside the extraction directory, often placing a payload in the Windows Startup folder.
- GIFTEDCROOK evolved from Excel macro droppers and Telegram exfiltration to in-memory DLL loading, direct NT system calls, and encrypted C&C infrastructure.
- The evolved stealer targets browser credentials, cookies, and files across many extensions, then self-deletes its staging artifacts after exfiltration.
- WinRAR remains a persistent target because it lacks auto-update and centralized enterprise patch management, leaving many endpoints exposed.
MITRE Techniques
- [T1566.001 ] Spearphishing Attachment – Earth Dahu delivered malicious RAR archives through email attachments (‘Emails with RAR archives impersonating Ukrainian judicial correspondence’).
- [T1204.002 ] User Execution: Malicious File – Victims had to open the archive and decoy document to trigger the hidden payload chain (‘Once the victim opens the archive, no further interaction is needed’).
- [T1059.001 ] PowerShell – SHADOW-EARTH-066 launched hidden PowerShell to read and execute the staged loader (‘cmd.exe /c start /min “” powershell -NoPr -Win Hidd -Ex Bypass’).
- [T1547.001 ] Startup Folder – Both campaigns used the Startup folder for persistence or delayed execution (‘the files execute’ from the Startup folder on next login).
- [T1564.004 ] NTFS File Attributes – WinRAR abused NTFS Alternate Data Streams to hide and write files outside the extraction directory (‘hidden ADS payloads that use path traversal’).
- [T1027 ] Obfuscated Files or Information – SHADOW-EARTH-066 used obfuscated PowerShell scripts and encoded payloads (‘Heavily obfuscated scripts … junk comment lines’).
- [T1620 ] Reflective Code Loading – The loader decoded and loaded a DLL entirely in memory (‘the decoded DLL is never written as a file’).
- [T1036 ] Masquerading – Decoy PDFs and spoofed document themes were used to appear legitimate (‘a court summons … or a defense ministry document’).
- [T1497 ] Virtualization/Sandbox Evasion – The stealer added sleep calls and timing delays to evade analysis (‘Sleep-based anti-sandbox calls’).
- [T1070.004 ] File Deletion – After exfiltration, the malware removed staging artifacts (‘DeleteFileW calls remove the remaining files’).
- [T1555.003 ] Credentials from Web Browsers – The stealer collected browser passwords and master keys (‘harvests browser passwords, session cookies’).
- [T1539 ] Steal Web Session Cookie – It extracted session cookies from Chromium-based browsers and Firefox (‘collects … cookies per profile’).
- [T1005 ] Data from Local System – The malware searched local folders for documents and sensitive files (‘scans the victim’s Documents, Downloads, and TEMP directories’).
- [T1041 ] Exfiltration Over C&C Channel – Stolen data was sent to dedicated servers over HTTPS POST (‘sent via HTTPS POST … to the /rcv/ path’).
- [T1071.001 ] Web Protocols – Command and control traffic used HTTP/HTTPS for connectivity checks and exfiltration (‘sends an HTTP GET … then sent via HTTPS POST’).
- [T1573.001 ] Encrypted Channel – SHADOW-EARTH-066 protected URLs and stolen data with RC4 before transmission (‘C&C URLs are RC4-encrypted in the binary’).
- [T1485 ] Data Destruction – Earth Dahu’s chain included destructive behavior through a wiper component (‘ClearSky … reported a Wiper component delivered through this chain’).
Indicators of Compromise
- [File names ] Staged payloads and decoys – bfF3BxteabXqg.lnk, KKN, ND8, and result.dll
- [File hashes ] Sample identification – SHA256 3d371ef71e40c34a75c168d4647db096c2f386499d99a88d4e16b63cd4acda25, and 2 more hashes
- [Domains ] Earth Dahu infrastructure and delivery – astrocaf[.]com, trycloudflare[.]com
- [IP addresses ] SHADOW-EARTH-066 C&C and related hosts – 166[.]0[.]132[.]237, 136[.]0[.]141[.]41, and 5 more IPs
- [Paths ] Startup and staging locations – %APPDATA%MicrosoftWindowsStart MenuProgramsStartup, C:ProgramData
- [URLs/URIs ] Exfiltration and proxy paths – hxxp://1[.]1[.]1[.]1, /rcv/
- [User-Agent strings ] Network detection – libcurl/8.14.0-DEV
Read more: https://www.trendmicro.com/en_us/research/26/f/old-winrar-flaw-fuels-attacks-on-ukraine.html