WinRAR CVE 2025 8088 and ADS NTFS the threat of Russian espionage that persists

Recent reports of malicious activity directed against Ukrainian organizations show a disturbing trend: known vulnerabilities in very widespread software are still exploited months after a patch is published. In this case the failure in question is CVE-2025-8088, a WinRAR route route failure that allows you to write files outside the extraction directory using the NTFS Alternate Data Streams (ADS), and that Microsoft and forensic tool manufacturers have been warning for some time about its use by actors with espionage motivations.

Recent research attributed separate campaigns to groups aligned with Russia - one associated with the family known as Gamaredon / Earth Dahu and another identified as SHADOW-EARTH-066 / UAC-0226 - that have incorporated such bug holdings into different infection chains. In the most innovative case the vector are no longer macro in Office documents but specially built RAR files that include a decoy PDF and several hidden payloads in ADS; one of those components is a direct access (.LNK) placed in the Start folder to run in the login, which triggers a memory load of a malicious DLL that steals credentials and browser cookies and looks for documents with relevant extensions.

The technical evolution of the adversary deserves attention: in addition to the change of delivery techniques, there is an important tactical movement in the way of exfiltering information. Where some operators used public channels such as Telegram to draw data, campaigns now tend to communicate with dedicated command and control servers; that change may be linked to platform restrictions within certain countries, but also implies that traditional network defenses should also focus on detecting outgoing connections to private malicious infrastructure.

The case illustrates two usual operational risks that need to be taken seriously. First, "daily-use" software that is not centrally managed - as compression utilities - can become a door for intruders if it is not patched or if applications remain present at stations outside IT administration. Second, less visible mechanisms of the file system, such as ADS, allow for the hiding of artifacts that are not shown by the superficial directory inspections, which makes detection difficult with basic tools.

To reduce immediate risk, organizations should prioritize correction and visibility: apply the WinRAR update that fixes CVE-2025-8088 and maintain a verifiable inventory of software facilities is the first step. In parallel, it is recommended to activate the advanced PowerShell and process creation record, to audit the Start folder in search of suspicious shortcuts and to monitor processes that launch cmd.exe to shoot loaders in memory. Tools like Sysinternals Streams help detect hidden ADS and Microsoft maintains technical documentation on how alternative currents work in NTFS, useful resources for incident response teams ( https: / / www.rarlab.com / news.htm, https: / / learn.microsoft.com / en-us / windows / win32 / filium / ntfs-alternate-data-streams, https: / / learn.microsoft.com / en-us / sysinterals / download / streams).

In the area of detection and continuous mitigation, it is key to deploy and refine EDR solutions that identify techniques such as DLs memory loading, user profile handling of shortcuts, and exfiltration to external servers; block or inspect outgoing traffic to new PIs / suspicious domains and apply network segmentation reduces the impact if a computer is compromised. In addition to technical measures, access hygiene is critical: forcing the use of multifactor authentication, rotation of credentials after incidents and eliminating persistent sessions or sensitive cookies may limit the usefulness of stolen data.

Finally, it should be recalled that the effective defense against these campaigns is not only to apply an isolated patch, but to manage the attack surface in a comprehensive way: update policies, controls for user applications, monitoring of atypical artifacts such as ADS and shortcuts in Start, and a real response capacity that includes memory analysis and search for commitment indicators. The convergence of different actors in the exploitation of the same vulnerability is a clear sign that leaks in software management are quickly translated into sustained operational risks.