Russian Hackers Exploit WinRAR Flaw to Steal Data from Ukrainian Organizations Russian cyber threat groups are actively exploiting a patched WinRAR vulnerability (CVE-2025-8088) to infiltrate Ukrainian organizations, stealing passwords, session cookies, and sensitive files. Despite the flaw being fixed in July 2025, multiple Russia-aligned hacking collectives including SHADOW-EARTH-066 (UAC-0226) and Earth Dahu (Gamaredon) continue to weaponize it as recently as April 2026. The attacks begin with spear-phishing emails containing malicious RAR archives. When opened with an outdated WinRAR version, the exploit silently drops hidden payloads into the Windows Startup folder while displaying a decoy PDF. Upon the next login, the malware executes automatically, deploying an evolved version of the GIFTEDCROOK information stealer. SHADOW-EARTH-066 has targeted Ukrainian military innovation centers, law enforcement, and local governments near the eastern border. Earth Dahu, active since at least 2013, delivers espionage tools via HTML Application (HTA) files hosted on Cloudflare Workers. Both groups exploit the same unpatched entry point, though their toolsets differ. The malware, internally named result.dll, extracts data from Chrome, Edge, Opera, and Firefox including passwords, session cookies, and master decryption keys while scanning for files with 35 extensions (e.g., spreadsheets, email files, KeePass databases). Stolen data is encrypted with dual-layer RC4 and exfiltrated over HTTPS to command-and-control (C&C) servers in France, the Netherlands, and Switzerland. After exfiltration, the malware removes staging files and Startup entries, minimizing forensic traces. GIFTEDCROOK’s evolution highlights increased sophistication: earlier versions used Telegram bots with plaintext tokens, while the current variant employs encrypted HTTPS communication and a Chrome App-Bound Encryption bypass. PowerShell loaders are heavily obfuscated to evade detection, and the final payload never writes decoded files to disk. Other Russia-linked groups, including Sandworm, Turla, and Void Rabisu, have also exploited this vulnerability. The persistent abuse underscores a critical gap: WinRAR lacks automatic updates or enterprise patch management, leaving organizations vulnerable if manual updates are overlooked. Indicators of compromise (IoCs) include LNK or HTA files in the Startup folder, short alphanumeric files (e.g., KKN, ND8) in C:\ProgramData, and connections to C&C servers such as 166[.]0[.]132[.]237 (port 7044) and 194[.]58[.]66[.]82. The malicious RAR archive sample analyzed has a SHA-256 hash of 3d371ef71e40c34a75c168d464d47db096f386499d99aa88d4e16b63cd4acda25.