How a Russian Threat Actor Uses a Recent WinRAR Vulnerability in Their Ukraine Operations - Synaptic Security Blog

Russian APT group Primitive Bear is actively exploiting a critical WinRAR vulnerability (CVE-2025-6218) to deliver multi-stage malware via spear-phishing RAR archives targeting Ukrainian military and government entities, enabling stealthy remote code execution and persistent surveillance.