Russian-Aligned RomCom and Elusive “Paper Werewolf” Exploit Zero-Day in Parallel Espionage Campaigns
Category: Cyber-Espionage / Zero-Day Exploitation
Features: Dual threat actor exploitation, CVE-2025-8088 zero-day, spearphishing delivery, cross-border targeting, overlapping TTPs
Delivery Method: Malicious WinRAR archive exploitation, phishing emails with weaponized attachments, privilege escalation via RAR-based payloads
Threat Actor: RomCom (Storm-0978) — Russia-aligned espionage cell; Paper Werewolf (Goffee) — independent phishing group targeting Russian institutions
Incident Overview
Two unrelated threat actors — one a Russia-aligned espionage group and the other a shadowy phishing crew with no confirmed state ties — exploited vulnerabilities in the widely used WinRAR file archiver during July–August 2025, according to research by ESET and BI.ZONE.
At the center is CVE-2025-8088, a zero-day allowing remote code execution (RCE) when a victim opens a malicious archive. ESET says RomCom was the first observed actor in the wild, launching targeted spearphishing against financial, manufacturing, defense, and logistics firms in Europe and Canada.
Targets received malicious résumés embedded in RAR archives; the moment they were opened, the exploit granted attackers direct execution capability. Although ESET could not confirm compromise rates, the victim profile strongly aligns with Russian geopolitical intelligence priorities.
RomCom’s Pattern of Zero-Day Abuse
RomCom, also tracked as Storm-0978, is no stranger to zero-day exploitation:
- 2023: Used an unpatched Microsoft Word flaw to target European defense and government entities.
- 2024: Leveraged a previously unknown Firefox bug to drop proprietary backdoors.
- 2025: Now adds CVE-2025-8088 to its arsenal — the third high-profile zero-day linked to its campaigns.
ESET’s assessment: RomCom has consistent access to fresh exploit code — either through in-house vulnerability research or a direct pipeline from private exploit brokers.
The Paper Werewolf Connection
In a separate but nearly parallel timeline, BI.ZONE reported that the little-known Paper Werewolf group (also called Goffee) exploited the same zero-day alongside a previous WinRAR bug, CVE-2025-6218 (patched June 2025).
- Delivery Vector: Phishing emails impersonating staff from the All-Russian Research Institute.
- Payload: Malicious RAR archives exploiting one or both vulnerabilities.
- Targets: Russian organizations, unnamed in BI.ZONE’s disclosure.
Key Differentiator: Paper Werewolf’s TTPs suggest forum-sourced exploits rather than organic development. BI.ZONE intelligence points to a Russian-language darknet sale of a WinRAR zero-day for $80,000, which may explain how the group acquired the capability.
Timeline of Exploitation
Early July 2025 — RomCom deploys CVE-2025-8088 in targeted phishing campaigns.
Mid–Late July 2025 — Paper Werewolf observed exploiting the same flaw, days after RomCom’s initial use.
August 2025 — BI.ZONE confirms combined exploitation of CVE-2025-8088 and CVE-2025-6218 in Russian-targeted attacks.
July 24, 2025 — WinRAR vendor releases patch for CVE-2025-8088 — six days after ESET discovery.
Threat Actor Profiles
RomCom (Storm-0978)
- Alignment: Russia-linked cyber-espionage.
- Past Ops: European/NATO defense targeting, advanced phishing, custom loader/backdoor chains.
- Tradecraft: Zero-day exploitation, sector-specific spearphishing, persistence in high-value environments.
Paper Werewolf (Goffee)
- Alignment: No confirmed state backing; historically targets Russian institutions.
- Past Ops: Custom malware (PowerModul) capable of stealing data from USB drives.
- Tradecraft: Social engineering with official-document lures, malware purchased or sourced via criminal forums.
- Notable: At least one confirmed case of operational disruption, hinting at sabotage potential beyond intelligence collection.
Exploit Mechanics
CVE-2025-8088 — Zero-day RCE triggered upon opening a crafted archive in vulnerable WinRAR versions. Exploit chain enables attacker-controlled code execution with current user privileges.
CVE-2025-6218 — Known flaw allowing arbitrary code execution when handling specially crafted archives or compromised download paths; patched June 2025.
In both cases, exploitation requires user interaction (opening the file), making phishing delivery an optimal vector.
TRJ Forecast
- Post-Patch Weaponization: Expect widespread adoption of CVE-2025-8088 in criminal ransomware operations now that proof-of-concept code is circulating.
- Forum Monetization: Darknet zero-day markets will see increased demand for client-side application exploits with low patch adoption rates.
- State-Criminal Crossovers: Future campaigns may blur attribution lines — state groups leasing criminal exploits or vice versa.
- WinRAR as a Persistent Target: Legacy install bases + user complacency will keep it a favored vector for espionage and crime alike.
TRJ Verdict
This is not just a case of two unrelated groups hitting the same hole in the same software — it’s a real-time demonstration of how zero-day exploitation now operates on a multi-actor timeline. RomCom, with suspected state resources, can deploy a zero-day against strategic sectors before the vendor even issues a patch. Within days, an entirely separate group — with no formal state affiliation — can weaponize the same flaw, thanks to an underground exploit economy willing to sell for the right price.
That convergence makes attribution less about “who found it first” and more about how fast capabilities move between actors. In CVE-2025-8088, we see that the gap between discovery and multi-actor exploitation can be measured in days, not months — and that’s an escalation that makes patch timelines, even fast ones, dangerously tight.
For defenders, this means WinRAR needs to be treated as an active security perimeter — not just a utility. For policymakers, it means zero-day markets aren’t just theoretical — they’re already a bridge between espionage and cybercrime. And for everyone else, it’s a warning: the same exploit that fuels geopolitics can just as easily power ransomware against your network tomorrow.
🔥 NOW AVAILABLE! 🔥
📖 INK & FIRE: BOOK 1 📖
A bold and unapologetic collection of poetry that ignites the soul. Ink & Fire dives deep into raw emotions, truth, and the human experience—unfiltered and untamed.
🔥 Kindle Edition 👉 https://a.co/d/9EoGKzh
🔥 Paperback 👉 https://a.co/d/9EoGKzh
🔥 Hardcover Edition 👉 https://a.co/d/0ITmDIB
🔥 NOW AVAILABLE! 🔥
📖 INK & FIRE: BOOK 2 📖
A bold and unapologetic collection of poetry that ignites the soul. Ink & Fire dives deep into raw emotions, truth, and the human experience—unfiltered and untamed just like the first one.
🔥 Kindle Edition 👉 https://a.co/d/1xlx7J2
🔥 Paperback 👉 https://a.co/d/a7vFHN6
🔥 Hardcover Edition 👉 https://a.co/d/efhu1ON
Get your copy today and experience poetry like never before. #InkAndFire #PoetryUnleashed #FuelTheFire
🚨 NOW AVAILABLE! 🚨
📖 THE INEVITABLE: THE DAWN OF A NEW ERA 📖
A powerful, eye-opening read that challenges the status quo and explores the future unfolding before us. Dive into a journey of truth, change, and the forces shaping our world.
🔥 Kindle Edition 👉 https://a.co/d/0FzX6MH
🔥 Paperback 👉 https://a.co/d/2IsxLof
🔥 Hardcover Edition 👉 https://a.co/d/bz01raP
Get your copy today and be part of the new era. #TheInevitable #TruthUnveiled #NewEra
🚀 NOW AVAILABLE! 🚀
📖 THE FORGOTTEN OUTPOST 📖
The Cold War Moon Base They Swore Never Existed
What if the moon landing was just the cover story?
Dive into the boldest investigation The Realist Juggernaut has ever published—featuring declassified files, ghost missions, whistleblower testimony, and black-budget secrets buried in lunar dust.
🔥 Kindle Edition 👉 https://a.co/d/2Mu03Iu
🛸 Paperback Coming Soon
Discover the base they never wanted you to find. TheForgottenOutpost #RealistJuggernaut #MoonBaseTruth #ColdWarSecrets #Declassified
Support truth, health, and preparedness by shopping the Alex Jones Store through our link. Every purchase helps sustain independent voices and earns us a 10% share to fuel our mission. Shop now and make a difference!
https://thealexjonesstore.com?sca_ref=7730615.EU54Mw6oyLATer7a
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
Great info. The kind you don’t want to hear about if you’re a WinRAR user (I use it very very occasionally and only on otherwise difficult archives to open, which is its greatest strength) but I am glad I read through this and more informed now. Thanks!
I appreciate that — and you’re right, it’s not the kind of news any WinRAR user wants to hear. Even occasional use is enough to warrant a quick update, especially with zero-days like this moving fast between different actors. Glad the piece helped get it on your radar. 😎