WinRAR Vulnerability Exploited to Target Government Agencies

WinRAR Vulnerability Exploited to Target Government Agencies

Information:

  WinRAR is a program for managing data, whether files or folders. You can use the program to compress various data files to the desired smaller size or to extract compressed zip files back into normal files and folders for use. It supports compression of .RAR and .ZIP file types and comes with a system for secure and confident protection, management, and file sharing.

Encryption is performed every time using AES 256-bit technology to enhance security. You can set passwords and metadata.

Incident :

  APT-C-08 exploits WinRAR vulnerability CVE-2025-6218, a directory traversal flaw affecting WinRAR versions 7.11 and earlier.The issue stems from improper path normalization during file extraction, specifically when paths contain a space after the “..” notation, allowing attackers to bypass security checks.This is the first observed case of APT-C-08 weaponizing this vulnerability.Due to the vulnerability’s low exploitation complexity and the widespread failure of users to update WinRAR, it provides an ideal attack surface.

Attack Methods :

  Attackers deliver weaponized RAR archives via email or file-sharing platforms.When victims extract the RAR file using vulnerable WinRAR versions, the flaw allows malicious files to be written into restricted directories.The attack implants a weaponized Normal.dotm file into Microsoft Word’s Templates directory.When Word is opened, malicious macros execute automatically without user interaction.The macros connect to a C2 (command-and-control)  server to download additional payloads and execute remote commands.Attackers gather system information and deliver further malware such as C# trojans, maintaining persistent access.

Attack Details :

Exploitation TechniqueAttackers embed malicious paths such as:

• /.. /.. /AppData/Roaming/Microsoft/Templates/Normal.dotm and
• /.. /.. /.. /AppData/Roaming/Microsoft/Templates/Normal.dotm

A space after “..” enables bypassing WinRAR path validation.When extracted, the malicious Normal.dotm is placed in:

• C:Users[username]AppDataRoamingMicrosoftTemplates

Payload Behavior Normal.dotm contains auto-executing malicious macros.Macros download additional components such as winnsc.exe. The downloader collects: Hostname, Username, OS version Data is sent to C2 (Command and Control) servers:teamlogin.esanojinjasvc[.]com And tapeqcqoptions[.]com Additional payloads include C# trojans associated with APT-C-08.

Solution :

1.Users should immediately update WinRAR to the latest version that includes a fix for the CVE-2025-6218 vulnerability.Avoid

2.opening RAR files from untrusted or unknown sources, as this vulnerability can be exploited through specially crafted archive files.

3.Run WinRAR or any extraction tools in a restricted environment, such as a sandbox or virtual machine (VM), to reduce risk if the file contains malicious code.

4.Use antivirus software and Endpoint Detection and Response (EDR) solutions that can detect and block potential threats.

5.Limit write permissions in critical directories, such as the Startup folder or user profile directories, to reduce the chance of malicious files being planted.

6.Educate users to be cautious about opening RAR files or email attachments from untrusted sources.

7.Limit WinRAR execution permissions to administrators only to enhance security layers.

The important things is Security systems. We must concern and monitor as usual.
For more information please contact
Email :sales@inetms.co.th
065 149 2822 (Ms.Suphatson )
063 204 4534 (Ms.Atsamaphorn)
065 929 6330 (Ms.Kansinee)
061 387 9439 (Ms.Sirilak)
092 257 6902 (Ms.Narusorn)
063 197 7510 (Mr.Yanotai)
065 725 7405 (Ms.Nattharini)

References :

• https://gbhackers.com/winrar-vulnerability-2/
• https://github.com/absholi7ly/CVE-2025-6218-WinRAR-Directory-Traversal-RCE
• https://www.scworld.com/brief/expanding-bitter-apt-operation-exposed
• https://www.secpod.com/blog/archive-terror-dissecting-the-winrar-cve-2025-6218-exploit-apt-c-08s-stealth-move/

Weekly Interesting CVE

Malware News or Campaign IOC/IOA | EN

Ref:https://www.truesec.com/hub/blog/glassworm-self-propagating-vscode-extension