🧰 WinRAR

The items that name it 10

• ESET Research (@ESETresearch) on X
  threadas affected products2026-10-30
• The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
  articleas affected products2026-10-15It is written here as WinRAR (vulnerability used in UAT-6275 infection chain).

  vulnerability used in UAT-6275 infection chain

• Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
  articleas affected products2026-10-14It is written here as WinRAR (CVE-2025-8088).

  CVE-2025-8088

• The First 24 Hours: What Happens When Ransomware Lands
  writeupas tools2026-10-02

  Named in CISA's Akira advisory as used for data staging during exfiltration

• DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer
  writeupas affected products2026-09-22

  Affected by CVE-2023-38831 extension-spoofing flaw exploited in earlier Water Hydra campaigns

• Akira Hits Safe Mode: Ransomware Rebooting Around EDR
  writeupas tools2026-08-12

  Downloaded and installed mid-intrusion to recursively archive mapped file shares for exfiltration, using flags 'a -ep1 -scul -r0 -iext -imon1', consistent with prior Akira/SonicWall campaign tradecraft.

• It’s Not Safe To Pay SafePa
  writeupas tools2026-07-17

  Used by the threat actor to archive data collected from hosts prior to exfiltration.

• Akira, LimeWire, and the Sour Taste of Data Exfiltration
  writeupas tools2026-06-12

  Archival tool used by the threat actor to archive contents of a share folder

• DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
  writeupas tools2026-06-08

  Used by Grixba v1/v1.5 to compress reconnaissance output into an unprotected export.zip.

• ESXi Exploitation in the Wild
  writeupas tools2026-01-07

  Used to stage data for exfiltration from a mapped network share