More than 100 unique exploits of a WinRAR bug have been identified since security researchers discovered a 19-year-old vulnerability in the file compression system.

Antivirus products may not immediately recognize persistent malware installed via the code execution flaw in the Windows-based utility, which was initially uncovered by Check Point. In a recent blog post, McAfee researchers noted that attackers are mostly targeting U.S. users, hoping to reach them before they install a patch that was released late last month.

WinRAR Bug Puts 500 Million Users at Risk

With a series of screenshots, McAfee illustrated a typical exploit that leveraged an illegal version of “thank u, next,” the hit song by pop singer Ariana Grande. Threat actors set up a payload containing malware in the Startup folder while a version of WinRAR containing the flaw extracted the MP3 file to a download folder.

User Account Control does not apply in this case, the researchers added, which means a user wouldn’t get a signal that the payload was installed. Once the system reboots, the malware starts running.

WinRAR is a popular tool with an estimated 500 million users, which means the scope for threat actors to pursue exploits is particularly large. It’s also common to see bootlegs such as the Ariana Grande song widely available on underground forums and torrent sites, which can provide plenty of opportunity to take advantage of the flaw.

No, Thank You: How to Avoid the WinRAR Bug

While the best recourse for most users is to simply avoid suspicious downloads and apply the patched version, WinRAR 5.70, that may not be enough to protect entire organizations. According to IBM experts, there is often a disconnect between IT security teams and operations teams when it comes to information related to critical software patches.

With the right patch posture reporting tools, security professionals can conduct a comprehensive assessment of devices that may be vulnerable to something like the WinRAR bug, then filter and sort data based on the most appropriate remediation priority. Given how quickly threat actors are trying to capitalize on this flaw, there’s no time to lose.

More from

Bridging the 3.4 Million Workforce Gap in Cybersecurity

As new cybersecurity threats continue to loom, the industry is running short of workers to face them. The 2022 (ISC)2 Cybersecurity Workforce Study identified a 3.4 million worldwide cybersecurity worker gap; the total existing workforce is estimated at 4.7 million. Yet despite adding workers this past year, that gap continued to widen.Nearly 12,000 participants in that study felt that additional staff would have a hugely positive impact on their ability to perform their duties. More hires would boost proper risk…

The Evolution of Antivirus Software to Face Modern Threats

Over the years, endpoint security has evolved from primitive antivirus software to more sophisticated next-generation platforms employing advanced technology and better endpoint detection and response.  Because of the increased threat that modern cyberattacks pose, experts are exploring more elegant ways of keeping data safe from threats.Signature-Based Antivirus SoftwareSignature-based detection is the use of footprints to identify malware. All programs, applications, software and files have a digital footprint. Buried within their code, these digital footprints or signatures are unique to the respective…

How Do Threat Hunters Keep Organizations Safe?

Neil Wyler started his job amid an ongoing cyberattack. As a threat hunter, he helped his client discover that millions of records had been stolen over four months. Even though his client used sophisticated tools, its threat-hunting technology did not detect the attack because the transactions looked normal. But with Wyler’s expertise, he was able to realize that data was leaving the environment as well as entering the system. His efforts saved the company from suffering even more damage and…

The White House on Quantum Encryption and IoT Labels

A recent White House Fact Sheet outlined the current and future U.S. cybersecurity priorities. While most of the topics covered were in line with expectations, others drew more attention. The emphasis on critical infrastructure protection is clearly a top national priority. However, the plan is to create a labeling system for IoT devices, identifying the ones with the highest cybersecurity standards. Few expected that news. The topic of quantum-resistant encryption reveals that such concerns may become a reality sooner than…