ClosedHighPatched
WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)
RARLAB WinRAR
WinRAR before 6.23 would run hidden code when a user opened what looked like a harmless file inside a ZIP. Group-IB found it exploited since April 2023 to target traders. After the fix, Google TAG saw Russian and Chinese government-backed groups pile on.
Why this severity: CVSS 7.8 (NVD), zero-day, actively exploited (CISA KEV), known ransomware use
- Started
- Aug 2, 2023
- Closed
- Oct 18, 2023
Affected
- Before 6.23 (NVD)
Fixed in
- 6.23
Updates by day4
Advisories3
News & write-ups2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
