A WinRAR flaw fixed in July 2025 is still emptying data out of Ukrainian government desks in June 2026. Two Russia-aligned crews, Gamaredon and SHADOW-EARTH-066, are running CVE-2025-8088 against military and government targets eleven months after the patch shipped. That’s not a patching failure in the usual sense. It’s a cybersecurity blind spot in the part of the endpoint nobody pretends to manage: the dozens of free desktop utilities your users installed before you ever saw their laptop.

WinRAR is the poster child. There’s no MSI from the vendor. No auto-update by default. No central console. Most enterprises don’t know what version is running on any given machine, and most users have no idea WinRAR has had a CVE at all. The fix has existed for almost a year. The fix is not deployed.

Your endpoint inventory ends at Office

Walk through what your CMDB actually tracks on the Windows fleet. The OS. The browser. Office. The EDR agent. Maybe Java, if you’re still cursed with it. Maybe Adobe Reader. After that, the picture goes dark.

Then walk through what’s actually installed on a typical knowledge-worker laptop: WinRAR, 7-Zip, Notepad++, PuTTY, FileZilla, VLC, VS Code, Git, Python, Node, Postman, half a dozen browser-based PDF tools, three different screen-capture utilities, and whatever the user grabbed from a SourceForge mirror in 2019.

Every one of those is an executable code path running with user privileges. Every one is a potential CVE waiting for someone to weaponize. And almost none of them get the patch attention of a Patch Tuesday Microsoft update.

This is the surface CVE-2025-8088 lives on. A path traversal in WinRAR’s archive handling lets an attacker write files outside the extraction directory, including into startup folders. Gamaredon’s campaign is the obvious play: spearphish a Ukrainian government target, attach a booby-trapped RAR, drop a stealer to %APPDATA%/Startup, and you have persistence on the next login. Eleven months in, it still works because the software is still vulnerable on the desk.

Two other failures from the same week

The WinRAR campaign is keeping company in this week’s headlines. France is investigating a breach of Tchap, the government’s Matrix-based secure messaging platform, after attackers hijacked a single civil servant’s account and walked into public chat rooms. The platform did what it was designed to do. The account did what an unprotected account does.

And the Russian-language operation dubbed SiribClone has been running romance lures against Russian soldiers in border regions since at least summer 2025, posing as women on messaging apps to extract location and unit data. No CVE. No exploit. Just attention and patience.

Stack those three together and the through-line is clear. The hard part of defense in 2026 is the long tail: the freeware on the laptop, the password on the messaging account, the soldier with a phone. Threat detection that only watches the server racks misses all three.

What to actually do this week

Pick the boring controls first. They work.

• Inventory third-party desktop software. Use what you already have: Defender for Endpoint software inventory, Intune discovered apps, osquery, Tanium, even a one-off PowerShell sweep of installed programs. Output a single CSV with hostname, app name, version. Sort by app. The picture will surprise you.
• Force-deploy current WinRAR (7.13 or later) and 7-Zip across the fleet today. Package it once. Ship it. Don’t wait for a ticket.
• Set a quarterly cycle for the next twelve third-party apps in your inventory. Most have silent-install switches and most are smaller than a Chrome update.
• Strip executable archive handlers from email gateways and SharePoint. RAR, ISO, IMG, VHD, LNK inside ZIP. If a user genuinely needs them, route through a sandbox.
• Turn on AppLocker or WDAC in audit mode on a pilot ring. The goal is visibility into what’s actually running. Enforcement can come later.
• Enforce phishing-resistant MFA on every account that touches a messaging platform, internal or government-provided. Tchap learned this the hard way.
• Update the incident response playbook for client-side persistence. If your IR runbook assumes initial access lands on a server, rewrite it.

Then build the longer arc. Security hardening on endpoints is not a one-time exercise. Defense in depth means assuming the user will install something you didn’t approve, the patch will lag, and the attacker will find the gap. Brute-force controls on the auth surfaces in front of any user-installed remote tool (PuTTY, RDP clients, VPN clients) cover the next gap when the patching cycle inevitably slips again. Cyber security programs that treat client software as out of scope are betting against an attacker who has already won that bet for eleven straight months.

Threat-protection is a habit of asking what’s running on the boxes you don’t think about.

Sources

• WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine
• Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs
• French government messaging platform breached through account hijacking
• Hackers pose as women seeking romance to spy on Russian soldiers