Gamaredon WinRAR Vulnerability Data Theft Campaign (CVE-2025-8088) | MSSP Advisory

Risk Assessment

Russian FSB-linked group Gamaredon is actively exploiting CVE-2025-8088, a vulnerability in WinRAR, to deliver a modular malware chain beginning with a weaponized HTML Application file called GammaPhish. From there, VBScript downloaders fingerprint the host, pull arbitrary payloads from C2 servers, and deploy GammaWorm for persistence and lateral spread via malicious LNK files. GammaSteel, the information stealer in this chain, exfiltrates targeted file types to AWS S3 buckets while using Telegram for C2 communication and NTFS Alternate Data Streams to hide its components from standard detection.

If any of your clients or your own staff open RAR attachments and WinRAR is unpatched, this chain runs quietly, fingerprints the machine, and starts pulling files before most endpoint tools catch it. The C2 traffic hides inside Telegram, which your firewall probably treats as legitimate business traffic. If GammaSteel runs in a client environment and you had not flagged a known WinRAR CVE, that is a hard conversation about whether you are actually managing their security posture.