UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations

UAT-6275 hackers have used a known WinRAR flaw to plant malware on Windows systems while targeting government organizations across the Commonwealth of Independent States (CIS). The activity shows how an unpatched archive tool can turn a routine attachment into lasting remote access, with the malicious program starting when the victim next signs in. The campaign involves CVE-2025-8088, a path traversal flaw that lets crafted archives write files outside the folder chosen for extraction. Researchers observed the group adding this method in April 2026, alongside older attacks using Word macros, executable downloaders, and malicious shortcuts. The wider activity reviewed ran…