Russian Cybercrime Groups Exploit WinRAR Zero-Day Vulnerability
By
chrisjj
9mo ago· 2 min readenNews
70/100
Toasty
Bagelometer↗
Crisped on the outside, thoughtful enough on the inside.
Score70TypenewsSentimentnegative
Summary
A high-severity zero-day vulnerability in WinRAR is being actively exploited by two Russian cybercrime groups, allowing them to backdoor computers through malicious archive files attached to phishing messages. Security firm ESET detected the attacks starting July 18, confirming the exploitation by July 24.
Key quotes
· 3 pulledA high-severity zero-day in the widely used WinRAR file compressor is under active exploitation by two Russian cybercrime groups.
Security firm ESET said Monday that it first detected the attacks on July 18, when its telemetry spotted a file in an unusual directory path.
By July 24, ESET determined that the behavior was linked to the exploitation of an unknown vulnerability in WinRAR.
Exploits allow for persistent backdooring when targets open booby-trapped archive.
