Update WinRAR now: Zero-Day WinRAR Bug Exploited by Russian and Chinese Hackers

Yet, Google’s Threat Analysis Group (TAG) reports that despite the fix, multiple state-affiliated hacking entities are still exploiting this vulnerability, primarily targeting users who have not yet updated their software. Their in-depth research, shared with TechCrunch, suggests that these exploits can be attributed to hacking syndicates associated with the governments of Russia and China.

Among the implicated parties is Sandworm, a notorious hacking group connected to Russian military intelligence. Sandworm has been previously implicated in major cyberattacks, such as the devastating NotPetya ransomware attack in 2017 which severely impacted Ukraine. TAG’s analysis suggests that in September, Sandworm misused the WinRAR vulnerability in a malicious email campaign, posing as a Ukrainian drone warfare training institution.

Another well-known Russian-affiliated hacking entity, Fancy Bear (or APT28), is also reported to have used the WinRAR exploit, targeting Ukrainian entities with deceptive emails seemingly sent by the Razumkov Centre, a Ukrainian public policy institute. Fancy Bear gained international infamy following their 2016 attack on the Democratic National Committee.

Further insights by Cluster25, a threat intelligence firm, echo these findings, having observed similar exploitation tactics traced back to Russia. Their assessment suspects Fancy Bear to be the main orchestrator.

Furthermore, Google’s experts have identified another cyber espionage group, APT40, believed to be backed by the Chinese state, as an abuser of the same WinRAR flaw. This group reportedly targeted individuals in Papua New Guinea via phishing campaigns carrying the CVE-2023-38831 exploit.

In light of these revelations, TAG emphasizes the significance of timely software updates, highlighting that even after vulnerabilities are known and patched, they can still be potent weapons in a hacker’s arsenal due to delayed user updates.