---
title: Critical WinRAR Vulnerability Under Active Attack by Russian, Chinese, and Criminal Groups
description: Hackers exploit WinRAR flaw CVE-2025-8088 to attack Ukrainian entities and spread ransomware, despite a patch available since July.
canonical_url: https://codekeeper.co/ticker/hackers-exploit-winrar-vulnerability-cve-2025-8088
---

# Critical WinRAR Vulnerability Under Active Attack by Russian, Chinese, and Criminal Groups

Hackers exploit WinRAR flaw CVE-2025-8088 to attack Ukrainian entities and spread ransomware, despite a patch available since July.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jan 29, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Google's Threat Intelligence Group warns that hackers are actively exploiting a critical WinRAR vulnerability (CVE-2025-8088) discovered and patched in July 2025. The flaw allows attackers to drop malicious files into Windows Startup folders through specially crafted RAR archives. Russian groups like APT44 and Turla are targeting Ukrainian military and government entities, while Chinese actors deploy POISONIVY malware. Criminal groups are also using the exploit to spread ransomware and steal data from commercial targets. The vulnerability works by hiding malicious payloads in decoy files within RAR archives. When users open these files, the exploit writes malware to critical system directories for persistence. Despite a patch being available since July 30, widespread exploitation continues across diverse threat operations. **Source:** [Google Cloud Blog](https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar-vulnerability)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-exploit-winrar-vulnerability-cve-2025-8088%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Russian Hackers Exploited Zimbra Zero-Day to Target US and Ukrainian Organizations Aug 11, 2026](https://codekeeper.co/ticker/russian-hackers-exploit-zimbra-flaw)

[Cyber Attack Forces Great Marlow School to Partially Close Aug 12, 2026](https://codekeeper.co/ticker/malware-attack-hits-great-marlow-school-it-systems)

[Cyberattacks CISA Flags a WSO2 Flaw Already Under Active Exploitation Sep 28, 2026](https://codekeeper.co/ticker/cisa-wso2-vulnerability-cve-2026-5430)

[Critical N-Central Flaw Gives Hackers Full Admin Access to MSP Platforms Aug 11, 2026](https://codekeeper.co/ticker/critical-n-central-rmm-vulnerability-cve-2026-18577)