A known vulnerability in the file-archiving tool WinRAR continues to proliferate because not enough users are installing the patch, according to Google.
The company today warned that “multiple government-backed hacking groups” have been exploiting the flaw, dubbed CVE-2023-3883, to deliver malware. "The widespread exploitation of the WinRAR bug highlights that exploits for known vulnerabilities can be highly effective, despite a patch being available,” Google wrote in a blog post.
WinRAR actually patched the flaw on Aug. 2 with version 6.23, after hackers had been abusing it since April. The only problem is that WinRAR lacks an auto-update feature, meaning users have to manually download and install updates from WinRAR’s website to stay protected.
“A patch is now available, but many users still seem to be vulnerable,” Google says.
The company has observed state-sponsored hackers taking advantage of the flaw in recent weeks, including “Sandworm,” a Russian-state sponsored group suspected of having ties to the country’s military. Last month, Google uncovered a phishing email that looked like it came from a Ukrainian drone warfare training school targeting Ukrainian users.
(Credit: Google)“The email contained a link to an anonymous file-sharing service, fex[.]net, which delivered a benign decoy PDF document with a drone operator training curriculum and a malicious ZIP file exploiting CVE-2023-38831,” Google added. Opening a document within the ZIP file can secretly trigger a PC to install an “infostealer” malware program capable of pilfering login credentials.
In a separate incident, Google found evidence that another Russian-state sponsored hacking group dubbed “Fancy Bear” created a phishing page to trick Ukrainian users into downloading a ZIP file that can also exploit the WinRAR flaw. “The decoy document was an event invitation from Razumkov Centre, a public policy think tank in Ukraine,” Google says.
Chinese state-sponsored hackers have also been abusing the flaw. In late August, a separate group dubbed APT40 launched a phishing campaign targeting users in Papua New Guinea. “The phishing emails included a Dropbox link to a ZIP archive containing the CVE-2023-38831 exploit, a password-protected decoy PDF, and an LNK file,” Google says. The result can secretly load a backdoor onto a computer.
As a result, Google is urging WinRAR users to update their software. “These recent campaigns exploiting the WinRAR bug underscore the importance of patching and that there is still work to be done to make it easy for users to keep their software secure and up-to-date,” it says.
We reached out to WinRAR for comment about if the program will ever add an auto-update feature, and will update the story if we hear back. In the meantime, WinRAR's website says it has over 500 million users worldwide.
