WinRAR's Security Vulnerability Exploited by Russian and Chinese Hackers

Google security researchers have discovered evidence that government-backed hackers linked to Russia and China are exploiting a previously patched vulnerability in WinRAR, a popular archiving tool for Windows. The vulnerability, known as CVE-2023-38831, allows attackers to hide malicious scripts in archive files. Despite an updated version of WinRAR being released, multiple state-backed hacking groups, including Sandworm and Fancy Bear from Russia, and APT40 from China, have been observed exploiting the flaw in targeted phishing campaigns. The ongoing exploitation of this bug highlights the effectiveness of known vulnerability exploits due to slow patching rates.