Gamaredon Keeps Riding the WinRAR Path-Traversal Bug Into Ukrainian Endpoints

Key points

• Gamaredon is actively exploiting CVE-2025-8088, a patched WinRAR path-traversal flaw, against Ukrainian targets.
• The attack chain runs from a GammaPhish HTA dropper through GammaWorm propagation to GammaSteel credential and document theft.
• WinRAR doesn't auto-update, and most enterprise endpoints have no mechanism to catch it running an old build.
• A Startup folder write is the pivot point, and a one-line Sysmon rule catches it.
• If WinRAR is in your inventory and you can't confirm it's patched, you're already a viable target.

Russia's Gamaredon hasn't lost a step. The crew, also tracked as Shuckworm and Armageddon, is still chaining a patched WinRAR path-traversal flaw into a full data-theft pipeline against Ukrainian targets, per research from Sekoia. The campaign tells you more about patch latency than about novel tradecraft.

CVE-2025-8088 is a directory traversal in WinRAR that lets a crafted archive drop files outside the intended extraction path. In practice, an attacker can write an HTA (an HTML Application, a Windows script format that runs with elevated trust) or LNK shortcut into a Startup folder or another autorun location while the user thinks they opened a document.

How the chain runs

That first-stage HTA is called GammaPhish. It pulls a follow-on payload; from there the operators branch into GammaWorm, which propagates over removable drives, and GammaSteel, the infostealer. We first covered GammaSteel on 2 June 2026, and the toolset hasn't changed its core purpose since. Same FSB-linked playbook, delivered through a file format nobody on the endpoint team treats as risky.

GammaSteel harvests browser credential stores, Telegram session files, and documents, exfiltrating over HTTP and Telegram bot APIs. GammaWorm's removable-drive propagation still works depressingly well in air-gapped-adjacent environments, which describes a lot of Ukrainian government networks.

The failure mode is boring

WinRAR doesn't auto-update on most workstations. A patched version exists. Anything older is still vulnerable, and there's no MDM nudge, no app store update, no telemetry ping when a finance analyst is running a build from 2022.

The lures lean on Ukrainian government and military pretexts, but the delivery path, archive attachment to traversal write to Startup to HTA execution, is generic enough that any group can replicate it. Treat it as commodity.

Should you worry?

Yes, if WinRAR is anywhere in your estate and you haven't confirmed it's patched. That includes build agents and jump hosts: somebody dropped WinRAR on a CI runner three years ago for a packaging step and nobody's touched it since. Inventory it with Intune, AWS Systems Manager Inventory, or GCP OS Config and actually look at the results.

The post-mortem on any infection from this campaign will note that nobody was watching for new files written to %AppData%\Microsoft\Windows\Start Menu\Programs\Startup. That's a one-line Sysmon rule. Defender for Endpoint and any half-configured EDR will alert on it if you write the detection.

Also: kill HTA execution. mshta.exe has no legitimate place on a corporate endpoint. Block it via WDAC or AppLocker.

This campaign fits the pattern we've tracked across recent Russian-nexus activity against Ukraine: persistent operators, low-novelty tooling, and victims who lag on patching commodity software. The bet Gamaredon is making, that WinRAR update rates are low enough to keep this profitable, is probably still paying off.