Security researchers say a newly disclosed WinRAR vulnerability in Microsoft Windows was exploited in a hacking campaign just days after disclosure, underscoring how quickly attackers can weaponize public flaws.
What Check Point Found
According to Check Point, the campaign used CVE-2025-8088, a path traversal vulnerability in WinRAR first disclosed in August 2025. The issue can be abused by crafting malicious archive files that enable arbitrary code creation, giving attackers a way to run code on targeted systems and maintain persistence.
That persistence can be used to quietly monitor users and collect sensitive information from compromised machines.
How the Attack Worked
Researchers said the attackers delivered lures through phishing emails that directed victims to malicious WinRAR files hosted on legitimate cloud storage services. The campaign was highly controlled, with infrastructure configured to interact only with victims in specific target countries.
One tool observed in the operation was Havoc Framework, an open-source command-and-control platform commonly used in authorized penetration testing and red teaming. Because of its legitimate uses, it may not always trigger security alerts.
- Phishing emails were used to deliver the lures
- Malicious archive files exploited CVE-2025-8088
- Havoc Framework was used for command and control
- Infrastructure was limited to specific target countries
Targets and Lures
Check Point said the attacks focused on government institutions and law enforcement agencies in Southeast Asia, indicating a cyber-espionage objective. The lures were tailored to local political, economic, or military developments, including topics such as government salary announcements and joint regional exercises.
The researchers concluded that the campaign was carried out by a group they dubbed Amaranth-Dragon. They said its tools, techniques, and procedures closely resemble those of APT 41, a prolific state-linked hacking group.
Why the Campaign Matters
Check Point said the case reflects a broader trend of sophisticated threat actors rapidly exploiting newly disclosed vulnerabilities. The company urged organizations, especially in government and critical infrastructure sectors, to prioritize patching and watch for suspicious archive files.
It also emphasized the importance of timely vulnerability management, user awareness, and defense-in-depth controls.
Key Takeaways for Defenders
Organizations can reduce risk by keeping archive software updated, reviewing suspicious emails carefully, and monitoring for unusual file activity associated with compressed archives.
In this campaign, speed was the attacker’s advantage. Rapid patching and strong email and endpoint defenses remain essential when new vulnerabilities are disclosed.