Paper Werewolf Exploits WinRAR Vulnerabilities in Espionage Campaigns
In July and early August 2025, the espionage-focused hacking group Paper Werewolf targeted multiple organizations in Russia and Uzbekistan. The campaign relied on phishing emails containing RAR archives that appeared to hold important documents but instead carried malware. The attackers exploited two vulnerabilities in WinRAR that allowed malicious software to be installed when an archive was extracted.
According to analysts at BI.ZONE, one of the group’s targets was a Russian manufacturer of specialized equipment. The attackers sent a phishing email impersonating a major research institute, using a compromised email account from an unrelated, legitimate company—a furniture manufacturer.
The attached RAR archive contained forged “documents from a ministry” alongside an executable file named XPS Viewer. While XPS Viewer is a legitimate application, the attackers had modified its executable to embed malicious code, enabling them to execute remote commands and seize control of the compromised system.
Researchers note that WinRAR is used by nearly 80% of Russian companies, and most employees with Windows-based corporate devices have it installed.
In the attack on the equipment manufacturer, Paper Werewolf exploited CVE-2025-6218, a vulnerability affecting WinRAR versions up to and including 7.11. Subsequent attacks in Russia and Uzbekistan leveraged a new, previously undisclosed zero-day affecting WinRAR version 7.12.
Shortly before these incidents, an advertisement appeared on a hacker forum offering what was allegedly a working exploit for this zero-day vulnerability, with the seller asking $80,000.
“Espionage-oriented threat groups continue to experiment with new methods and tools, expanding their arsenals with previously unknown vulnerabilities. By using RAR archives, attackers achieved two goals at once: exploiting WinRAR flaws to install malware, and increasing the likelihood that phishing emails would bypass filters—since such attachments are common in business correspondence,”
— Oleg Skulkin, Head of Threat Intelligence, BI.ZONE
