In July and early August 2025, the espionage hacking group Paper Werewolf attacked several organizations from Russia and Uzbekistan. The phishing emails had RAR archives attached, supposedly containing important documents, but in reality, they included malware. The attackers exploited two vulnerabilities in WinRAR, which allow the installation of malicious software when the archive is unpacked.
According to analysts from BI.ZONE, one of the group’s targets was a Russian manufacturer of special equipment. The attackers sent an email to the target on behalf of a large research institute, utilizing a compromised email address of another real company—a furniture manufacturer.
The RAR archive attached to the email contained fake “documents from the ministry” as well as an executable file for the XPS Viewer. This is a legitimate program, but the attackers modified its executable file by injecting malicious code. This enabled them to remotely execute commands and control the compromised device.
Researchers note that almost 80% of Russian companies and virtually all employees whose corporate devices run on Windows use WinRAR.
For attacking the aforementioned equipment manufacturer, Paper Werewolf exploited the vulnerability CVE‑2025‑6218, which affects WinRAR versions up to and including 7.11. In later attacks targeting companies in Russia and Uzbekistan, the attackers relied on a new, then-unknown zero-day vulnerability, which also affects WinRAR version 7.12.
Shortly before these attacks, an advertisement appeared on a hacking forum for the sale of a supposedly working exploit, presumably for this vulnerability. The seller was asking for $80,000 for it.
“Espionage-oriented groups continue to experiment with methods and tools, including adding new vulnerabilities to their arsenal. By using RAR archives, the attackers pursued two goals at once: not only exploiting vulnerabilities in WinRAR to install malware but also increasing the chances that the phishing email would bypass email filters, as such attachments are a common occurrence in business correspondence,” comments Oleg Skulkin, Head of BI.ZONE Threat Intelligence.