Paper Werewolf targets Russia with WinRAR zero-day vulnerability

The cluster continues its campaign against Russian organizations—this time exploiting WinRAR flaws

In July 2025, BI.ZONE Threat Intelligence uncovered a series of attacks carried out by the Paper Werewolf (GOFFEE) cluster. The threat actor exploited the directory traversal RCE vulnerability in WinRAR (CVE-2025-6218) along with a similar zero-day vulnerability that had not yet been assigned a CVE identifier at the time of this research.

CVE-2025-6218 affects WinRAR versions up to and including 7.11.

The zero-day vulnerability discovered by BI.ZONE Threat Intelligence affects versions up to and including 7.12.

As at the time of this research, ESET specialists reported a potentially similar flaw to the WinRAR developers. Shortly after, version 7.13 was released in which the vulnerability identified by us was patched.

Adversaries often send phishing emails impersonating major or well‑known organizations, as well as national regulators, or reference them for credibility. The stronger a brand, the more likely threat actors are to exploit its identity. Recognizable logos and other branding elements make phishing emails appear more authentic, prompting victims to open them. It is important to remember that the organizations whose brands are abused by attackers are not liable for the actions of criminals and the associated damage.

Key findings

• Cyber spies continue to demonstrate strong capabilities in bypassing defenses, enhancing their toolkits to successfully exploit vulnerabilities, particularly zero days.
• Malware delivered through archive files is more likely to evade email security filters as such attachments are common in legitimate correspondence.
• Despite their advanced skills, attackers still rely on a wide range of easily detectable tactics, techniques, and procedures (TTPs). Therefore, 24/7 incident monitoring remains essential for effective corporate defense.

Paper Werewolf attacks

Exploitation of CVE-2025-6218

In early July, BI.ZONE Threat Intelligence identified a targeted phishing campaign carried out by Paper Werewolf. The adversaries impersonated a Russian R&D institute representative and attached a letter purportedly from a government ministry. Notably, the phishing emails were sent from a compromised account of a legitimate furniture supplier.

Fig. 1. Phishing email

To determine whether a victim opened their phishing email, the attackers embedded a link to a hidden 1×1 pixel image within the message’s HTML code.

Fig. 2. Link to hidden image in phishing email

The email contained the RAR file minprom_04072025.rar which exploited CVE-2025-6218. This WinRAR vulnerability allows a malicious archive to extract and save files outside the intended target directory—including the startup folder—enabling code execution during the login process.

Fig. 3. Contents of minprom_04072025.rar

Extracting the archive on a victim computer creates a malicious executable in the startup folder: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\xpsrchvw74.exe. Additionally, the directory %SYSTEMDRIVE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup is created which contains the following identical executable files: xpsrchvw71.exe, xpsrchvw72.exe, and xpsrchvw73.exe.

Fig. 4. Exploiting CVE-2025-6218

The contents of decoy files contained in the RAR archive are shown below.

Fig. 5. Contents of письмо на СМ_(файл отображения).pdf (mapping file)

Fig. 6. Contents of Шаблон_запроса (7) (11).docx (request template)

xpsrchvw74.exe

The xpsrchvw74.exe file is a modified XPS Viewer (version 6.1.7600.16385). The threat actors embedded malicious shellcode (a reverse shell) into the executable. The shellcode connects to the C2 server 89.110.88[.]155:8090, thus providing remote access to the cmd.exe shell on a victim computer. It is noteworthy that the executable uses ROR13 hashing to obfuscate WinAPI function names.

Fig. 7. Fragment of malicious reverse shellcode

Exploitation of zero-day vulnerability in WinRAR

Attack dated 2025–07–22

In another Paper Werewolf attack, BI.ZONE Threat Intelligence discovered the malicious RAR Запрос_Минпромторг_22.07.rar (request from the Russian Ministry of Industry and Trade), which exploits a previously unknown zero-day directory traversal vulnerability in WinRAR.

The flaw stems from the archiver’s ability to include files with alternative data streams (ADS) which can contain arbitrary payloads. When an archive is extracted or a file is opened directly from within it, the data from ADS is written to arbitrary system directories, enabling a directory traversal attack. This vulnerability affects WinRAR versions up to and including 7.12 and is no longer reproducible starting from version 7.13.

Fig. 8. Contents of Запрос_Минпромторг_22.07.rar

Upon opening the decoy запрос Минпромторга РФ.pdf or extracting the RAR contents, the following files are created on a victim computer:

• %LOCALAPPDATA%\WinRunApp.exe
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\WinRunApp.lnk

Fig. 9. Exploiting zero-day vulnerability in WinRAR

The contents of the decoy embedded in Запрос_Минпромторг_22.07.rar are shown below.

Fig. 10. Contents of запрос Минпромторга РФ.pdf

It is worth mentioning that BI.ZONE Threat Intelligence discovered an underground forum post offering an allegedly functional WinRAR zero-day exploit for $80,000. While the post did not mention CVE-2025-6218, it is possible that the exploit offered for sale was related to the vulnerability we identified—and that Paper Werewolf may have purchased and adapted it for their attacks.

Fig. 11. Forum post offering WinRAR zero-day exploit for sale

WinRunApp.exe

The WinRunApp.exe executable is a malicious .NET application coded in C#. This is a loader that retrieves a payload (a .NET assembly) from the C2 server and runs it in memory. The payload itself was not available at the time of this research.

Once executed, the loader tries to create a mutex. If this fails, it terminates. The mutex used in the attack is Sfgjh824nf6sdfgsfwe6467jkgg3vvvv3q7657fj436jh54HGFa56.

Then the loader enters an endless loop, repeatedly attempting to download the payload from the C2 server. If a C2 response is not zero-length, the loop terminates. Otherwise, the loader goes to sleep for a while (in this case, for 331 seconds) and then tries again.

The loader also retrieves a computer name and username, then appends them to a URL sent to the C2 server to fetch the payload.

Such URL may look as follows:

hxxps://IndoorVisions[.]org/patriarchal/furthering/creating/flared/censured?hostname=[computer_name]&username=[username]

To access the C2 server, the loader uses the following User-Agent header strings: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.59".

The payload is a .NET assembly loaded into process memory via Assembly.Load and executed with the Invoke method. The payload is executed with a specific class and method defined in the loader configuration data. Here, these are the class "EatLanguageSubject.AnswerEndSight" and the method "PainGroupStep".

Fig. 12. Loader configuration data

Attacks dated 2025–07–31 and 2025–08–01

During these attacks, the adversaries also used malicious RAR files with the above zero-day vulnerability. This time, BI.ZONE Threat Intelligence discovered the archives named DON_AVIA_TRANS_RU.rar and DON_AVIA_TRANS_UZ.rar which included the following files: three PDF documents, one text file disguised as a PDF, and—embedded in ADS—an LNK file and a C# loader executable.

Fig. 13. Contents of DON_AVIA_TRANS_RU.rar

Fig. 14. Contents of DON_AVIA_TRANS_UZ.rar

In this case, the threat actors included ADS into every file within the archives. If a user opens any of the decoys or extracts the RAR contents, files similar to those observed in the previous attack will be created on a victim computer.

Fig. 15. Exploiting vulnerability in archive

Sample contents of the decoys Бриф компании.pdf (company brief) and Hamkorlik bo‘yicha aniqlashtiruvchisavollarga javoblar.pdf are shown below.

Fig. 16. Contents of Бриф компании.pdf

Fig. 17. Contents of Hamkorlik bo‘yicha aniqlashtiruvchi savollarga javoblar.pdf

The files Презентация.pdf and Presentation.pdf are identical (have the same checksum) and contain text data demonstrated below.

Fig. 18. Contents of Презентация.pdf (Presentation.pdf)

WinRunApp.exe

WinRunApp.exe is functionally nearly identical to the C# loader analyzed in the 2025-07-22 attack, except for the additional code that launches the file, if it exists within the system. The name of this file is not specified in the configuration data of the analyzed sample.

Fig. 19. Checking for file existence; file execution

Loader configuration data

Indicators of compromise

Exploitation of CVE-2025-6218

minprom_04072025.rar

MD5: 9a69b948e261363463da38bdbf828b14

SHA1: 40e647d61a00fd7240e54dba45ce95c5d33cae43

SHA256: fe2587dd8d9755b7b3a106b6e46519a1ce0a8191eb20821d2f957326dbf912e9

xpsrchvw.exe

MD5: 942220fc9382f44ae82061d1fc63f41e

SHA1: 7ff3d32e78c5626135a73bba4a011058f714ae86

SHA256: bf74820d40d281c28d5928b01e5b68d6caf85b5b9188bf4efb627765d708bcff

hxxps://eliteheirs[.]org/checks/brandished/dyestuffs/abbess/interrelation?4eab27f5266393a1150e7d6453c1920db480c2f88ce96708cff593e38ae8ac30

hxxps://eliteheirs[.]org/checks/brandished/dyestuffs/abbess/interrelation

hxxps://eliteheirs[.]org/crossness/outpost/autocracies/decapitations/jetsetting?b115ef3ad9cb948213f7efc4876cf67747eac173b613b425abd05dba0e306ebd

hxxps://eliteheirs[.]org/crossness/outpost/autocracies/decapitations/jetsetting

eliteheirs[.]org

89.110.88[.]155:8090

81.30.105[.]148

213.171.4[.]200

Exploitation of zero-day vulnerability in WinRAR

Запрос_Минпромторг_22.07.rar

MD5: 6b4d7a63aa2a8b2a5a3fbad6c8e6533e

SHA1: d3820a1248bf54ce8a3d05bf688bcd97e1c41d8e

SHA256: 28a2b98ae214376ccd549a8b0dccafad31c8b234d0b81a0e8817579566615567

DON_AVIA_TRANS_UZ.rar

MD5: eaba94b5237d2625fa38bc924e5347c4

SHA1: 6c0e52b8ed746b5b8ebef1ef2226093260659ae8

SHA256: d2c3fe8b9a4e0e5b7bcc087d52295ab30dc25b1410f50de35470383528c9d844

DON_AVIA_TRANS_RU.rar

MD5: d176b7b5040d7bb32bae4d5c3c3b6aaf

SHA1: b610ff2ad9791d17203609d747c5dfe947304591

SHA256: dfab2f25c9d870f30bbc4abb873d155cf4904ece536714fb9cd32b2e0126dfab

WinRunApp.exe

MD5: 1670035385c9031f79566c6f73fb9743

SHA1: b7bba4a216f4910f5072019bb4a2022ccf098c75

SHA256: 2446f97c1884f70f97d68c2f22e8fc1b9b00e1559cd3ca540e8254749a693106

WinRunApp.exe

MD5: 67daddd8fd8a59c8b3d40ea433efd6ff

SHA1: 23708d1fdcd7ba65c2b2fc676cee707e746a2dd9

SHA256: 236aba76d427111e8c140604ead9c4ab86264b1ae197fc26fadb33c46be94289

hxxps://indoorvisions[.]org/patriarchal/furthering/creating/flared/censured?hostname=[hostname]&username=[username]

hxxps://indoorvisions[.]org/patriarchal/furthering/creating/flared/censured

hxxps://trailtastic[.]org/glowworms/diverted/calorie/britons/parabolas?hostname=[hostname]&username=[username]

hxxps://trailtastic[.]org/glowworms/diverted/calorie/britons/parabolas

indoorvisions[.]org

trailtastic[.]org

89.110.98[.]26

94.242.51[.]73

Mutexes:

Sfgjh824nf6sdfgsfwe6467jkgg3vvvv3q7657fj436jh54HGFa56

Global_22576733

MITRE ATT&CK

How to protect your company from such threats

Building an effective cybersecurity strategy requires an understanding of the vulnerabilities that Paper Werewolf and similar threat actors may exploit in real attacks. For this purpose, we would recommend that you leverage the data from the BI.ZONE Threat Intelligence portal. It provides information about the current attacks, threat actors, their tactics, techniques, tools, and exploited vulnerabilities. This intelligence can help you stay proactive and accelerate your incident response.