Two Russian APT groups are targeting Ukrainian government and military networks using a WinRAR vulnerability that had a patch available nearly a year before they started exploiting it.
Trend Micro researchers identified active exploitation of CVE-2025-8088, a path traversal flaw in WinRAR rated 8.4 on the CVSS severity scale. One of the groups is Gamaredon, a Russian state-linked actor with a documented history of operations against Ukrainian institutions. The attack chain delivers credential-stealing malware, with government and military systems as the apparent priority. The fix has been available for nearly a year — leaving every organization that skipped it fully exposed.
A CVSS 8.4 flaw in archiving software installed across a large share of Windows desktops is a durable weapon for any attacker content to let patch fatigue do the work. The continued targeting of Ukrainian military and government infrastructure confirms the cyber dimension of that conflict is still active, and that delayed patching — not a shortage of defenders — remains the more persistent gap.
A campaign this reliant on an old, fixable flaw suggests the attackers see no urgency to upgrade their toolkit. When the target has not patched in a year, why would they need to?