WinRAR malware and phishing lures show how archive abuse persists

At a glance

What this is: Anomali’s Cyber Watch highlights how WinRAR exploitation, Erlang OTP abuse, ransomware tradecraft, and phishing campaigns continue to turn trusted software and identity cues into initial access paths.

Why it matters: For IAM and NHI practitioners, the common pattern is that attackers keep converting trusted workflows, credentials, and software trust into persistence or execution, which broadens identity and access exposure beyond classic login abuse.

By the numbers:

• 17 minutes
• 27 days
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.

👉 Read Anomali’s Cyber Watch on WinRAR malware, Erlang OTP exploitation, and ransomware activity

Context

Archive abuse, phishing lures, and unpatched perimeter services remain effective because attackers only need one weak link between user trust and code execution. In this case, WinRAR path traversal turned a familiar file format into a delivery channel, while related campaigns show how quickly adversaries pivot when they find a reliable foothold.

The identity angle is that these campaigns increasingly depend on credential handling, startup persistence, and exposed access paths rather than just malware delivery. That makes them relevant to IAM, PAM, NHI governance, and endpoint teams alike, because once a trusted workflow is compromised, downstream access and lateral movement become much easier.

Key questions

Q: What breaks when malicious archives can write into startup locations?

A: A malicious archive that can place files in startup locations turns a single delivery event into delayed code execution. The user may only see a normal attachment, but the payload activates later without another delivery step. That breaks the assumption that extraction is a safe, low-risk action and makes startup monitoring and path controls critical.

Q: Why do exposed services remain such an effective entry point for attackers?

A: Exposed services are effective because they bypass the need for user interaction and often sit close to privileged system functions. When authentication is missing or weak, attackers can move from external probing to code execution in one step. That is why perimeter services must be treated as identity-relevant assets, not just infrastructure.

Q: How can security teams know whether archive abuse is being contained?

A: Teams should look for three signals: blocked attempts to write outside extraction paths, detonation results that show dropped executables or LNK files, and endpoint alerts for unusual autorun persistence. If those signals are absent, the environment may be accepting archive-based delivery without seeing the handoff to execution.

Q: Who is accountable when phishing files lead to code execution?

A: Accountability usually spans email security, endpoint security, and the business owner of the exposed workflow. If a malicious attachment can reach a user and then create persistent execution, the control failure is shared across delivery, inspection, and host hardening. Frameworks such as CIS Controls and NIST SP 800-53 expect that shared boundary to be governed.

Technical breakdown

WinRAR path traversal and malicious archive staging

A path traversal flaw in an archive handler lets an attacker control where extracted files land, even when the file appears to be a normal compressed attachment. In this campaign, malicious RAR files used alternate data streams and hidden paths to place executables and LNK files into predictable locations such as user startup directories. That turns extraction into execution, because the payload survives until the next logon or user action. The evasion value comes from noise. Bogus paths and benign-looking warnings distract reviewers while the real payload is staged separately.

Practical implication: block or tightly inspect archive formats that can write outside expected extraction paths and treat extracted startup artifacts as a high-risk indicator.

Phishing, persistence, and delayed execution

These campaigns combine social engineering with persistence engineering. The lure gets the archive opened, but the attacker still needs code to run later, often through logon-triggered items, scheduled tasks, or other auto-start mechanisms. That delay lowers the chance of immediate detection and makes the malicious payload look like ordinary user activity. When an intrusion relies on a trusted file plus a deferred trigger, defenders need to think in terms of execution chain, not just initial delivery. The security problem is not only the phishing email, but the fact that the file format itself is being used as a staging layer.

Practical implication: correlate email filtering, sandbox detonation, and startup-item monitoring so deferred execution is visible before the payload activates.

Credential exposure in adjacent intrusion chains

Several of the threats in this roundup show how attackers move from initial foothold to credential abuse or service disruption. The Erlang OTP exploitation chain targets unauthenticated remote code execution on exposed services, while other campaigns use stolen credentials, valid accounts, or authentic-looking authorisations to deepen access. In identity terms, this is where the line between malware and access control breaks down. Once an attacker can run code or approve a trusted action, they can often reach other systems without needing to defeat strong authentication again.

Practical implication: prioritise internet-facing services and trust approvals that can convert execution into authenticated access, especially where privileged accounts or service identities are reachable.

Threat narrative

Attacker objective: The attacker wants reliable foothold, persistence, and downstream control that can support espionage, credential theft, or ransomware deployment.

1. Entry occurs through phishing RAR files or exposed services that give the attacker a path into the environment.
2. Escalation follows when archive extraction, startup persistence, or remote code execution enables the payload to run with the victim context or higher privilege.
3. Impact comes from backdoor deployment, lateral movement, ransomware execution, or credential-enabled follow-on access across the environment.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Archive exploitation is really a trust exploitation problem. WinRAR abuse works because users, mail systems, and endpoint controls still treat compressed attachments as ordinary business content. The attacker is not breaking encryption or defeating authentication first. They are exploiting the gap between what a file looks like and what it can do once extracted, which makes file handling policy part of access governance.

Deferred execution is the control gap that gives these campaigns room to breathe. Malicious archives often do not execute immediately. They stage payloads into startup paths, scheduled tasks, or other delayed triggers, which means the real compromise happens after the initial handoff. That is why execution monitoring and post-extraction inspection matter as much as email filtering. The practical lesson is that containment must cover the time between delivery and first run.

Identity controls need to extend beyond login events into trusted workflow abuse. The stronger identity lesson in this roundup is that attackers increasingly use legitimate-looking actions, valid accounts, or serviceable trust chains to move from code execution to real access. That is where IAM, PAM, and NHI governance intersect with endpoint security. Access review alone will miss the issue if the compromise happens inside a workflow that was assumed safe.

Standing trust in software and services is becoming a repeatable intrusion primitive. The same pattern appears across archive abuse, OTP exploitation, and credential-driven campaigns: an exposed or trusted path becomes the shortest route to operational control. That pushes defenders toward reducing implicit trust in files, services, and connected identities. Practitioners should treat trusted execution paths as security boundaries, not conveniences.

From our research:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• From our research: The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Forward look: Use Ultimate Guide to NHIs , Key Challenges and Risks to pressure-test whether exposed secrets, service identities, and delayed remediation are creating avoidable blast radius.

What this signals

Archive-based intrusion chains are still valuable because they compress the distance between delivery and execution. For defenders, that means mail controls alone are insufficient if the endpoint can still auto-execute or stage payloads after extraction. The operational signal to watch is whether your environment can see file-to-process transitions fast enough to stop deferred payloads before they run.

Trust boundaries around files, services, and identity approvals are becoming the real perimeter. A security programme that separates endpoint defence from identity governance will miss how attackers move from a malicious file to a privileged action. That is especially true when service identities, startup triggers, or approved connected workflows can be abused to turn a single foothold into durable access.

Credential exposure windows remain brutally short once an attacker has a usable path. Our research shows that exposed AWS credentials are probed within 17 minutes on average, which is why exposed secrets, active sessions, and delayed detection are converging into one governance problem. Practitioners should tighten the handoff between detection, containment, and credential invalidation before the window closes.

For practitioners

• Harden archive handling paths Prevent archive extractors from writing outside approved directories and flag any RAR or ZIP file that attempts to create files in startup or autorun locations. Pair this with detonation of suspicious archives before they reach users.
• Monitor delayed execution artefacts Alert on new LNK files, scheduled tasks, and unexpected service creation after archive opens, because those are the most common handoff points between delivery and payload execution.
• Prioritise exposure on internet-facing services Treat missing-authentication bugs and externally reachable management services as first-order risk because they convert directly into remote code execution and follow-on access.
• Review trust boundaries in connected workflows Map where user actions, file handling, and service identities can trigger privileged outcomes without a second control check, then remove or segment those pathways.

Key takeaways

• This roundup shows that trusted software paths remain attractive because they let attackers turn ordinary files or services into execution points.
• The evidence points to a recurring problem: once a payload or secret is exposed, adversaries move quickly enough that slow remediation can no longer be treated as acceptable.
• Teams should focus on file-handling controls, exposed-service hardening, and faster identity and credential containment because those are the controls that actually reduce blast radius.

Key terms

• Archive Path Traversal: A file extraction weakness that allows an attacker to write content outside the intended destination folder. In practice, this can turn a harmless-looking compressed attachment into a delivery mechanism for executables, shortcuts, or persistence artefacts placed where the operating system will run them later.
• Alternate Data Stream: An alternate data stream is hidden file content stored alongside a normal file on Windows systems. Attackers use it to conceal payloads or metadata in ways that are less visible to users and some security tools, which makes it useful for staging malware inside apparently benign archives.
• Delayed Execution: Delayed execution is a tactic where the payload is arranged to run later rather than immediately after delivery. Common triggers include logon, scheduled tasks, startup folders, or service start events. This reduces detection chances because the malicious action occurs after the original delivery step has faded from view.
• Exposed Service: An exposed service is a network-reachable application or protocol endpoint that can be probed from outside the trusted boundary. When authentication is missing or weak, it becomes a direct route to code execution, credential abuse, or foothold establishment without requiring user interaction.

What's in the full analysis

Anomali’s full Cyber Watch post covers the operational detail this post intentionally leaves for the source:

• The exact malware payloads observed in the WinRAR campaign, including the backdoors and loaders linked to the malicious archives.
• The published indicators of compromise and analyst notes that help SOC teams validate whether similar activity is present in their environment.
• The full Erlang OTP exploitation context, including the affected services and the observed post-exploitation behaviour.
• The separate campaign and ransomware tradecraft details that sit behind the high-level campaign summary.

👉 Anomali’s full post includes the campaign specifics, observed indicators, and linked intrusion details.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and workload identity. It is designed for practitioners who need to connect identity controls to broader security operations.