State Actors Targeting WinRAR Flaw in Multiple Campaigns

Several APT groups, including two highly capable and active Russian teams, are running campaigns to target a known vulnerability in the popular WinRAR archive utility and deliver a variety of commodity and custom malware and backdoors.

The attackers are going after CVE-2023-38831, a bug in many versions of the WinRAR utility that can lead to arbitrary code execution. The WinRAR team released a patch for the flaw in August, but cybercrime groups had been exploiting it since at least April, …

apt apt groups archive attackers backdoors bug campaigns cve cve-2023-38831 flaw known vulnerability malware popular running russian state target targeting teams utility vulnerability winrar winrar flaw