Notifications
Clear all
Topic starter
02/08/2026 12:31 pm
TL;DR: RomCom used a patched WinRAR path traversal flaw to deliver backdoors through phishing RAR files, hiding payloads with alternate data streams and Startup-folder persistence while ESET tracked job-application lures across Europe and Canada, according to Anomali. Archive-based delivery still works because user trust, manual patching, and weak file handling controls remain exploitable.
NHIMG editorial — based on content published by Anomali: Anomali Cyber Watch on WinRAR malware, Erlang OTP exploitation, Charon ransomware, and related activity
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when malicious archives can write into startup locations?
A: A malicious archive that can place files in startup locations turns a single delivery event into delayed code execution.
Q: Why do exposed services remain such an effective entry point for attackers?
A: Exposed services are effective because they bypass the need for user interaction and often sit close to privileged system functions.
Q: How can security teams know whether archive abuse is being contained?
A: Teams should look for three signals: blocked attempts to write outside extraction paths, detonation results that show dropped executables or LNK files, and endpoint alerts for unusual autorun persistence.
Practitioner guidance
- Harden archive handling paths Prevent archive extractors from writing outside approved directories and flag any RAR or ZIP file that attempts to create files in startup or autorun locations.
- Monitor delayed execution artefacts Alert on new LNK files, scheduled tasks, and unexpected service creation after archive opens, because those are the most common handoff points between delivery and payload execution.
- Prioritise exposure on internet-facing services Treat missing-authentication bugs and externally reachable management services as first-order risk because they convert directly into remote code execution and follow-on access.
What's in the full analysis
Anomali’s full Cyber Watch post covers the operational detail this post intentionally leaves for the source:
- The exact malware payloads observed in the WinRAR campaign, including the backdoors and loaders linked to the malicious archives.
- The published indicators of compromise and analyst notes that help SOC teams validate whether similar activity is present in their environment.
- The full Erlang OTP exploitation context, including the affected services and the observed post-exploitation behaviour.
- The separate campaign and ransomware tradecraft details that sit behind the high-level campaign summary.
👉 Read Anomali’s Cyber Watch on WinRAR malware, Erlang OTP exploitation, and ransomware activity →
WinRAR path traversal and Startup abuse: what teams need to know?
Explore further
02/08/2026 1:28 pm
Archive exploitation is really a trust exploitation problem. WinRAR abuse works because users, mail systems, and endpoint controls still treat compressed attachments as ordinary business content. The attacker is not breaking encryption or defeating authentication first. They are exploiting the gap between what a file looks like and what it can do once extracted, which makes file handling policy part of access governance.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when phishing files lead to code execution?
A: Accountability usually spans email security, endpoint security, and the business owner of the exposed workflow. If a malicious attachment can reach a user and then create persistent execution, the control failure is shared across delivery, inspection, and host hardening. Frameworks such as CIS Controls and NIST SP 800-53 expect that shared boundary to be governed.
👉 Read our full editorial: WinRAR malware and phishing lures show how archive abuse persists
