WinRAR Security Flaw Exploited in Zero-Day Attacks to Target Traders
![Image](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYUR50BadvS84dpF9Zb-z5GaDxyaDSjjDdL4CcblyDb-5vGm76uh_ZoFePeU8k-0J3pUZxe0VbLyblYicNhnLfZqG4GAUKihHc8Ep0WKyTtj4wZNov3Ecv1wtU_zF9z1_pRay6v1oR1-9iOg4BviLRwMGOToHIUqdX6sTGoEfZ8cNpBWvEvBlLhA1t5rA/w640-h334/winrar.jpg)
A recently patched security flaw in the popular WinRAR archiving software has been exploited as a zero-day since April 2023, new findings from Group-IB reveal. The vulnerability, cataloged as CVE-2023-38831 , allows threat actors to spoof file extensions, thereby making it possible to launch malicious scripts contained within an archive that masquerades as seemingly innocuous image or text files. It was addressed in version 6.23 released on August 2, 2023, alongside CVE-2023-40477. In attacks discovered by the Singapore-based firm in July 2023, specially crafted ZIP or RAR archive files distributed via trading-related forums such as Forex Station have been used to deliver a variety of malware families such as DarkMe, GuLoader, and Remcos RAT. "After infecting devices, the cybercriminals withdraw money from broker accounts," Group-IB malware analyst Andrey Polovinkin said, adding as many as 130 traders' devices have been compromised as part of the campaign. The total nu