Several Russian companies have been subjected to intrusions exploiting the already-patched WinRAR vulnerability, tracked as CVE-2023-38831, by the PhantomCore cyberespionage operation, which has been linked to Ukraine, reports The Record, a news site by cybersecurity firm Recorded Future. Attacks commenced with the distribution of phishing emails with a contract-spoofing PDF document and a password-protected RAR archive, which when executed delivers the PhantomRAT remote access malware that allows data exfiltration, a report from Russian Group-IB spinoff F.A.C.C.T revealed.

Source: SC Magazine