Critical WinRAR Vulnerability Exploited: Google’s Threat Analysis Group Alert

Google LLC’s Threat Analysis Group has warned regarding a security vulnerability in WinRAR, a file archiving and compression software. This vulnerability was identified as CVE-2023-3883. Various hacking groups, actively exploit it, some of which are state-sponsored entities.

Google TAG’s researchers have observed these hacking groups using the CVE-2023-3883 vulnerability, primarily in WinRAR versions prior to 6.23. This vulnerability allows attackers to execute arbitrary code when a user attempts to access a seemingly harmless file within a ZIP archive.

Critical WinRAR Vulnerability Exploited: Google’s Threat Analysis Group Alert

The initial detection of this vulnerability dates back to April and the company released a patch. However, there are still numerous users who remain vulnerable. The flaw lies within WinRAR’s file extraction logic, enabling attackers to run arbitrary code on a user’s system.

The exploit occurs when a user tries to view a file within a ZIP archive using WinRAR. The logical flaw allows attackers to deceive the system into running malicious code rather than opening the intended file.

See Also: Sony Faces Ransomware Attack: Hackers Claim to Have Breached All Networks

This vulnerability is being exploited by both alleged state-sponsored hackers and those motivated by financial gains. Notably, it was initially used to target financial traders. The Google TAG report draws particular attention to two concerning groups: Frozenbarents and Frozenlake. Both are believed to have ties to GRU, Russia’s foreign military intelligence agency.

Frozenbarents has been discovered impersonating a Ukrainian training school to deliver malware. At the same time, Frozenlake has targeted Ukrainian government organizations, with a specific focus on the nation’s energy infrastructure. Both groups have used the WinRAR vulnerability to distribute malware, emphasizing the critical nature of the issue.

Islanddreams, another group believed to have connections to entities in China, also leveraged this vulnerability to target Papua New Guinea. Their campaign involved phishing emails that contained a Dropbox link to a ZIP archive.

Rarlab GmbH, the German company responsible for WinRAR, released a patch for this vulnerability in August. Nevertheless, Google’s researchers stress the significance of promptly applying patches and increasing awareness among users and organizations regarding the risks associated with outdated software. They emphasize that the widespread exploitation of the WinRAR vulnerability underscores how effective known vulnerabilities can be, even when patches are available, and that attackers will do whatever is necessary to achieve their objectives.