Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open Two separate Russia-aligned campaigns are still exploiting the WinRAR flaw CVE-2025-8088 against Ukrainian organizations nearly a year after it was patched, showing how unmanaged software keeps an exploited entry point open long after the fix ships. Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open | Trend Micro (US) search close About Mission and Culture …

https://www.trendmicro.com/en_us/research/26/f/old-winrar-flaw-fuels-attacks-on-ukraine.html

sha256:ca5f38582cd4fe78673311e863350dd277ba8859461f41d588c59e8dd8a0f5e3

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve4
md50
url2
ipv410
ipv60
sha10
domain28
sha2561
malware_token0
attack_pattern17
threat_actor_token4

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	cmd.exe	Open →
domain	powershell.exe	Open →
cve	CVE-2025-8088	Open →
domain	mshta.exe	Open →
cve	CVE-2026-33017	Open →
domain	cookies.sqlite	Open →
domain

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports