Zero-Day in WinRAR Actively Weaponized by Multiple Threat Groups

A newly discovered zero-day flaw in WinRAR, tracked as CVE-2025-8088, has been actively exploited in targeted attacks, with threat groups like RomCom and Paper Werewolf using it to deliver malicious payloads through seemingly harmless RAR archives. The vulnerability, found in the Windows version of WinRAR, allows attackers to exploit path traversal via alternate data streams, enabling them to plant harmful files in sensitive locations. RomCom used spear-phishing campaigns against European and Canadian companies, deploying multi-stage attack chains that delivered malware including Mythic agents, SnipBot variants, and RustyClaw downloaders. Paper Werewolf threat actor purchased the exploit for $80,000 and targeted Russian organizations, sometimes chaining it with another WinRAR flaw. WinRAR has since patched the issue in version 7.13, making prompt updates essential to prevent compromise.