Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability

ESET researchers have identified a new zero-day vulnerability (CVE-2025-8088) in WinRAR, actively exploited by the Russia-aligned RomCom group through spearphishing campaigns. This path traversal flaw allows silent deployment of backdoors like SnipBot and Mythic agent upon archive extraction, targeting financial, manufacturing, defense, and logistics companies in Europe and Canada. WinRAR has since released a patch (version 7.13), urging immediate updates, underscoring RomCom's persistent use of zero-day exploits for targeted, potentially geopolitically motivated, attacks on critical sectors.

Analysis

ESET researchers have uncovered a significant zero-day vulnerability in WinRAR (CVE-2025-8088), a widely deployed file compression utility. The flaw was actively exploited by the sophisticated, Russia-aligned threat group RomCom in targeted spearphishing campaigns between July 18th and 21st, 2025. This marks at least the third instance of this group leveraging a zero-day, underscoring its high level of capability and investment in cyber operations. The campaign specifically targeted financial, manufacturing, defense, and logistics companies in Europe and Canada, indicating a strategic focus on espionage and intelligence gathering within critical sectors. Although WinRAR issued a patch (version 7.13) promptly on July 30th and ESET telemetry indicates no successful compromises from this specific campaign, the incident highlights a persistent and elevated risk. The vulnerability was also reportedly exploited by a second threat actor, broadening the potential impact and demonstrating the rapid weaponization of newly discovered flaws in the current geopolitical landscape.

Key Decisions for Investors

• Investors should intensify due diligence on the cybersecurity posture of portfolio companies within the finance, defense, and logistics sectors, as these industries are confirmed targets of sophisticated, state-aligned threat actors.
• The incident reinforces the bullish thesis for the cybersecurity industry, as the continuous emergence of high-impact, zero-day vulnerabilities drives sustained enterprise spending on advanced threat detection and rapid patch management solutions.
• Consider the heightened geopolitical risk factor in investment analysis, as actions by groups like RomCom directly link nation-state activities to corporate operational and financial risk, potentially impacting companies with strategic value or sensitive data.
• Evaluate corporate exposure to widely used third-party software as a potential systemic risk, focusing on the speed and efficacy of a company's incident response and vulnerability management protocols.