HighPhishingCVE-2025-8088
UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations
Cyber Security News·Source published ·1 min read
What happened?
UAT-6275 hackers have used a known WinRAR flaw to plant malware on Windows systems while targeting government organizations across the Commonwealth of Independent States (CIS). The activity shows how an unpatched archive tool can turn a routine attachment into lasting remote access, with the malicious program starting when the victim next signs in. The campaign involves CVE-2025-8088, a path traversal flaw that lets crafted archives write files outside the folder chosen for extraction.
Key details
- WinRAR path traversal flaw CVE-2025-8088 lets crafted archives write files outside the chosen folder.
- PickleShell is a C#/.NET reverse shell that poses as a Windows service component.
- Malware runs at next sign-in after being placed in Startup, giving attacker foothold without further prompt.
- Staging directories and GitHub repositories provided payloads, tool lists, and infrastructure changes for analysis.
What to look for
- SHA-256 hash 4627cc970b2af15a292e0286820ccec069507c827810b839e1c532a03206353c identifies the crafted RAR archive.
- SHA-256 hash 392b70086f10c23ce7b4173d1f68d72727ea0146260fb773c78642f6eb641775 identifies the PickleShell payload.
- SHA-256 hash cedc4ec0c238b1fc7a71dfa54f7d2d407539d22b87fe1c73b96b7a0dc17d4e40 identifies the macro-enabled Word document.
- SHA-256 hash a38af45a67fc9070d46649feab0b347011585d1e547fe88185e70dea6e6582ea identifies the Chvost reverse-shell sample.
- SHA-256 hash 6806029ed72de2b592c18edb430ffabd56137a8428b7c23860ae4f000a02f0af identifies the early Chvost sample.
- SHA-256 hash 697be7589b428f483736486a560f29088e3f8fa03a512b6ca8b606ace0186765 identifies the Armenian diplomatic-letter decoy.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.