Gamaredon Keeps Riding the WinRAR Path-Traversal Bug Into Ukrainian Endpoints

Russia's Gamaredon hasn't lost a step. The crew — also tracked as Shuckworm and Armageddon — is still chaining a patched WinRAR path-traversal flaw into a full data-theft pipeline against Ukrainian targets, and the campaign tells you more about patch latency than about novel tradecraft.

The bug is CVE-2025-8088, a directory traversal in WinRAR that lets a crafted archive drop files outside the intended extraction path. In practice, that means an attacker can write an HTA or LNK into a Startup folder or another autorun location while the user thinks they just opened a document.

That first-stage HTA is being called GammaPhish. It pulls a follow-on payload, and from there the operators branch into the GammaWorm propagator and the GammaSteel infostealer. Same FSB-linked playbook, just delivered through a file format that nobody on the endpoint team thinks of as risky.

The failure mode here is boring and familiar. WinRAR doesn't auto-update on most workstations. The fix shipped in WinRAR 7.13 back in the summer. Anything older is still vulnerable, and there is no MDM nudge, no app store update, no telemetry ping when a finance analyst is running a build from 2022.

A few things worth flagging for defenders.

Gamaredon's lures lean on Ukrainian government and military pretexts, but the delivery path — archive attachment, traversal write to Startup, HTA execution — is generic enough that any group can pick it up. Treat it as commodity now.

GammaSteel is doing the usual: browser credential stores, Telegram session files, document exfiltration over HTTP and Telegram bot APIs. GammaWorm propagates over removable drives, which still works depressingly well in air-gapped-adjacent environments.

One thing the post-mortem will say: nobody was watching for new files in %AppData%\Microsoft\Windows\Start Menu\Programs\Startup. That's a one-line Sysmon rule. Sentinel, Defender for Endpoint, and any half-configured EDR will alert on it if you bother to write the detection.

For the platform crowd, the cloud-side ask is straightforward. If your build agents or jump hosts have WinRAR installed — and they do, somebody put it there for a CI step three years ago — inventory it. Intune, Jamf, AWS Systems Manager Inventory, GCP OS Config. Pick one and actually look.

And kill HTA execution. mshta.exe has no business running on a corporate endpoint in 2024, let alone 2025. Block it via WDAC or AppLocker and move on.

Operational takeaway: if WinRAR is in your software inventory and you can't prove it's at 7.13 or later, you're the campaign's next data point.