Russian APT groups exploit unpatched WinRAR flaw in Ukraine

Two FSB-linked groups exploit CVE-2025-8088, a WinRAR path traversal vulnerability patched in July 2025, to deploy credential-stealing malware against Ukrainian targets. Trend Micro reports Gamaredon uses GammaSteel for exfiltration while SHADOW-EARTH-066 deploys GIFTEDCROOK to steal browser passwords and documents. Slow patch adoption enables continued exploitation.