Cyber Security

RomCom and others exploiting zero-day vulnerability

August 16, 2025

ESET researchers have found a beforehand unknown vulnerability in WinRAR, being exploited within the wild by Russia-aligned group RomCom. That is no less than the third time that RomCom has been caught exploiting a major zero-day vulnerability within the wild. Earlier examples embody the abuse of CVE-2023-36884 through Microsoft Phrase in June 2023, and the mixed vulnerabilities assigned CVE‑2024‑9680 chained with one other beforehand unknown vulnerability in Home windows, CVE‑2024‑49039, concentrating on weak variations of Firefox, Thunderbird, and the Tor Browser, resulting in arbitrary code execution within the context of the logged-in person in October 2024.

Key factors of this blogpost:

If you happen to use WinRAR or different affected elements such because the Home windows variations of its command line utilities, UnRAR.dll, or the transportable UnRAR supply code, improve instantly to the newest model.
On July 18th, 2025, ESET researchers found a beforehand unknown zero-day vulnerability in WinRAR being exploited within the wild.
Evaluation of the exploit led to the invention of the vulnerability, now assigned CVE-2025-8088: a path traversal vulnerability, made doable with using alternate knowledge streams. After rapid notification, WinRAR launched a patched model on July thirtieth, 2025.
The vulnerability permits hiding malicious information in an archive, that are silently deployed when extracting.
Profitable exploitation makes an attempt delivered varied backdoors utilized by the RomCom group, particularly a SnipBot variant, RustyClaw, and Mythic agent.
This marketing campaign focused monetary, manufacturing, protection, and logistics firms in Europe and Canada.

RomCom profile
RomCom (also referred to as Storm-0978, Tropical Scorpius, or UNC2596) is a Russia-aligned group that conducts each opportunistic campaigns towards chosen enterprise verticals and focused espionage operations. The group’s focus has shifted to incorporate espionage operations accumulating intelligence, in parallel with its extra standard cybercrime operations. The backdoor generally utilized by the group is able to executing instructions and downloading further modules to the sufferer’s machine.
The invention of CVE-2025-8088
On July 18th, 2025, we noticed a malicious DLL named msedge.dll in a RAR archive containing uncommon paths that caught our consideration. Upon additional evaluation, we discovered that the attackers had been exploiting a beforehand unknown vulnerability affecting WinRAR, together with the then-current model, 7.12. On July twenty fourth, 2025, we contacted the developer of WinRAR, and on the identical day, the vulnerability was fastened and WinRAR 7.13 beta 1 revealed. WinRAR 7.13 was revealed on July thirtieth, 2025. Customers of WinRAR are suggested to put in the newest model as quickly as doable to mitigate the chance. Be aware that software program options counting on publicly out there Home windows variations of UnRAR.dll or its corresponding supply code are affected as effectively, particularly people who haven’t up to date their dependencies.
The vulnerability, tracked as CVE-2025-8088, makes use of alternate knowledge streams (ADSes) for path traversal. Be aware {that a} related path traversal vulnerability (CVE‑2025‑6218) affecting WinRAR was disclosed on June nineteenth, 2025, roughly a month earlier.
The attackers specifically crafted the archive to apparently comprise just one benign file (see Determine 1), whereas it accommodates many malicious ADSes (there’s no indication of them from the person’s viewpoint).

Determine 1. Eli_Rosenfeld_CV2 – Copy (10).rar opened in WinRAR

As soon as a sufferer opens this seemingly benign file, WinRAR unpacks it together with all its ADSes. For instance, for Eli_Rosenfeld_CV2 – Copy (10).rar, a malicious DLL is deployed into %TEMP%. Likewise, a malicious LNK file is deployed into the Home windows startup listing, thereby reaching persistence through execution on person login.
To make sure increased success, the attackers offered a number of ADSes with rising depths of mum or dad listing relative path components (..). Nevertheless, this introduces nonexistent paths that WinRAR visibly warns about. Apparently, the attackers added ADSes that comprise dummy knowledge and are anticipated to have invalid paths. We suspect that the attackers launched them in order that the sufferer doesn’t discover the suspicious DLL and LNK paths (see Determine 2). Solely when scrolling down within the WinRAR person interface are the suspicious paths revealed, as seen in Determine 3.

Determine 2. Displayed WinRAR errors when unpacking Eli_Rosenfeld_CV2 – Copy (10).rar

Determine 3. Displayed WinRAR errors when unpacking Eli_Rosenfeld_CV2 – Copy (10).rar; scrolled down and highlighted

Compromise chain
In response to ESET telemetry, such archives had been utilized in spearphishing campaigns from the 18th to twenty first July, 2025, concentrating on monetary, manufacturing, protection, and logistics firms in Europe and Canada. Desk 1 accommodates the spearphishing emails – sender, topic, and filename of the attachment – used within the campaigns, and Determine 4 exhibits the message we noticed in an e mail. In all circumstances, the attackers despatched a CV hoping {that a} curious goal would open it. In response to ESET telemetry, not one of the targets had been compromised.
Desk 1. Spearphishing emails noticed in ESET telemetry

Sender
Topic
Attachment

Simona <2constheatcomshirl@seznam.cz>
Skilled Web3 Developer вЂ“ CV Hooked up for Consideration
Eli_Rosenfeld_CV2 – Copy (100) – Copy – Copy – Copy – Copy – Copy – Copy.rar

Eli_Rosenfeld_CV2 – Copy (100) – Copy – Copy – Copy – Copy – Copy.rar

Eli_Rosenfeld_CV2 – Copy (100) – Copy – Copy – Copy – Copy.rar

Eli_Rosenfeld_CV2 – Copy (10).rar

Marshall Rico <geoshilovyf@gmx.com>
Motivated Applicant – Resume Enclosed
cv_submission.rar

Simona <93leocarperpiyd@seznam.cz>

Simona <93geoprobmenfuuu@seznam.cz>

Simona <2constheatcomshirl@seznam.cz>

Simona <3tiafratferpate@seznam.cz>

Russell Martin <sampnestpihydbi@gmx.com>
Job Software
Datos adjuntos sin título 00170.dat

Pepita Cordero <stefanmuribi@gmx.web>
Software for Job Openings – Pepita Cordero
JobDocs_July2025.rar

Sacchetti Jami <patricklofiri@gmx.web>
Software for Job Openings – Sacchetti Jami
Recruitment_Dossier_July_2025.rar

Jennifer Hunt <emponafinpu@gmx.com>
Making use of for the Position
cv_submission.rar

Determine 4. Noticed e mail message

These RAR information at all times comprise two malicious information: a LNK file, unpacked to the Home windows startup listing, and a DLL or EXE, unpacked to both %TEMP% or %LOCALAPPDATA%. A number of the archives share the identical malware. We now have recognized three execution chains.
Mythic agent execution chain
Within the first execution chain, depicted in Determine 5, the malicious LNK file Updater.lnk provides the registry worth HKCUSOFTWAREClassesCLSID{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}InprocServer32 and units it to %TEMPpercentmsedge.dll. That is used to set off execution of that DLL through COM hijacking. Particularly, the CLSID corresponds to the PSFactoryBuffer object current in npmproxy.dll. In consequence, any executable making an attempt to load it (e.g., Microsoft Edge) will set off code execution of the malicious DLL. This DLL is answerable for decrypting embedded shellcode through AES and subsequently executing it. Apparently, it retrieves the area identify for the present machine, which generally accommodates the corporate identify, and compares it with a hardcoded worth, exiting if the 2 values don’t match. Which means the attackers had carried out reconnaissance beforehand, confirming that this e mail was extremely focused.
The loaded shellcode seems to be a dynamichttp C2 profile for the Mythic agent having the next C&C server: https://srlaptop[.]com/s/0.7.8/readability.js.

Determine 5. Mythic agent execution chain

It comes with a regular configuration for the dynamichttp C2 profile and a customized one, which is displayed in Determine 6. Similar to within the earlier stage, this configuration accommodates a hardcoded area identify of the goal.
{‘disable_etw’: ‘2’, ‘block_non_ms_dlls’: ‘3’, ‘child_process’: ‘wmic.exe’, ‘use_winhttp’: 1, ‘inject_method’: ‘1’, ‘dll_side’: [‘MsEdge’, ‘OneDrive’], ‘area’: ‘[REDACTED]’}
Determine 6. Customized configuration within the Mythic execution chain
SnipBot variant execution chain
Within the second execution chain, which is depicted in Determine 7, the malicious LNK file Show Settings.lnk runs %LOCALAPPDATApercentApbxHelper.exe. It’s a modified model of PuTTY CAC, which is a fork of PuTTY, and is signed with an invalid code-signing certificates. The additional code makes use of the filename as a key for decrypting strings and the subsequent stage, which is shellcode. The shellcode seems to be a variant of SnipBot, malware attributed to RomCom by UNIT 42. Execution of the shellcode solely proceeds if a particular registry worth (68 for this pattern) is current within the HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerRecentDocs registry key (in different phrases, if no less than 69 paperwork had been not too long ago opened); that is an anti-analysis method to stop execution in an empty digital machine or sandbox. If no less than 69 paperwork had been not too long ago opened, next-stage shellcode is decrypted utilizing the registry key identify (e.g., 68, however transformed from string to integer), and executed, downloading yet one more stage from https://campanole[.]com/TOfrPOseJKZ.
We additionally discovered an an identical ApbxHelper.exe inside Adverse_Effect_Medical_Records_2025.rar, uploaded to VirusTotal from Germany. This archive additionally exploits the CVE-2025-8088 vulnerability.

Determine 7. SnipBot variant execution chain

MeltingClaw execution chain
Within the third execution case, which is depicted in Determine 8, the malicious LNK file Settings.lnk runs %LOCALAPPDATApercentComplaint.exe, which is RustyClaw – a downloader written in Rust beforehand analyzed by Talos. This pattern is signed with an invalid code-signing certificates, which is totally different from the code-signing certificates used within the SnipBot variant. RustyClaw downloads and executes one other payload, from https://melamorri[.]com/iEZGPctehTZ. This payload (SHA-1: 01D32FE88ECDEA2B934A00805E138034BF85BF83), with inside identify install_module_x64.dll, partially matches the evaluation of MeltingClaw by Proofpoint, a distinct downloader attributed to RomCom. The C&C server of the MeltingClaw pattern that we noticed is https://gohazeldale[.]com.

Determine 8. MeltingClaw execution chain

Attribution
We attribute the noticed actions to RomCom with excessive confidence based mostly on the focused area, TTPs, and malware used.
This isn’t the primary time that RomCom has used exploits to compromise its victims. In June 2023, the group carried out a spearphishing marketing campaign concentrating on protection and governmental entities in Europe, with lures associated to the Ukrainian World Congress. The Microsoft Phrase doc connected to the e-mail tried to take advantage of the CVE‑2023‑36884 vulnerability, as documented by the BlackBerry Risk Analysis and Intelligence workforce.
On October eighth, 2024, the group exploited a then-unknown vulnerability within the Firefox browser. The exploit focused a use-after-free vulnerability in Firefox Animation timelines, permitting an attacker to attain code execution in a content material course of, with the target of delivering the RomCom backdoor. The vulnerability identifier CVE‑2024‑9680 was assigned, as documented in our WeLiveSecurity blogpost.
Different actions
We’re conscious that this vulnerability has additionally been exploited by one other menace actor, and was independently found by the Russian cybersecurity firm BI.ZONE. Notably, this second menace actor started exploiting CVE‑2025‑8088 just a few days after RomCom began doing so.
Conclusion
By exploiting a beforehand unknown zero-day vulnerability in WinRAR, the RomCom group has proven that it’s keen to take a position critical effort and sources into its cyberoperations. That is no less than the third time RomCom has used a zero-day vulnerability within the wild, highlighting its ongoing deal with buying and utilizing exploits for focused assaults. The found marketing campaign focused sectors that align with the everyday pursuits of Russian-aligned APT teams, suggesting a geopolitical motivation behind the operation.
We want to thank the WinRAR workforce for its cooperation and fast response, and acknowledge its effort in releasing a patch inside simply at some point.
Due to Peter Košinár for his help within the evaluation.

For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at threatintel@eset.com.
ESET Analysis presents non-public APT intelligence experiences and knowledge feeds. For any inquiries about this service, go to the ESET Risk Intelligence web page.

IoCs
A complete listing of indicators of compromise (IoCs) and samples could be present in our GitHub repository.
Recordsdata

SHA-1
Filename
Detection
Description

371A5B8BA86FBCAB80D4E0087D2AA0D8FFDDC70B
Adverse_Effect_Medical_Records_2025.rar

LNK/Agent.AJN
Win64/Agent.GPM

Archive exploiting CVE‑2025‑8088; discovered on VirusTotal.

D43F49E6A586658B5422EDC647075FFD405D6741
cv_submission.rar

LNK/Agent.AJN July
Win64/Agent.GPM