shadow-earth-066, earth dahu

Executive Summary

Shadow-Earth-066 and Earth Dahu are Russia-aligned cyber threat actors targeting Ukrainian government and defense sectors using CVE-2025-8088, a WinRAR path traversal vulnerability. Their campaigns feature advanced information-stealing tools and persistent exploitation techniques despite patch availability. The actors demonstrate high sophistication in tool development and exploit persistence.

Goals & Targeting

These actors appear to have a strategic focus on targeting乌克兰's government and defense sectors, likely to support broader Russian geopolitical objectives or to facilitate espionage activities. Their selection of Ukrainian organizations suggests an intent to gain access to sensitive information, disrupt national security, and potentially influence ongoing conflicts in the region.

Two sophisticated cyber threat actors, Shadow-Earth-066 and Earth Dahu, have been observed leveraging the CVE-2025-8088 WinRAR vulnerability to target Ukrainian organizations in an ongoing campaign. Shadow-Earth-066 deploys an evolved GIFTEDCROOK information stealer that employs in-memory DLL loading via NT system calls to harvest browser credentials, session cookies, and documents across 35 file extensions before self-deleting. In contrast, Earth Dahu utilizes an HTA-based infection chain to deliver espionage modules through Cloudflare Workers infrastructure. Both actors share the CVE-2025-8088 exploit but diverge in their tooling: Shadow-Earth-066 relies on compiled C++ with RC4-encrypted command and control communication, while Earth Dahu adopts a script-based approach with Dynamic DNS for persistence. The sustained exploitation of this vulnerability for nearly a year post-patch underscores the risks posed by unmanaged software lacking centralized update mechanisms, which create persistent attack surfaces that threat actors can exploit over extended periods. This activity aligns with Russia's historical playbook of targeting critical infrastructure and government entities in Ukraine to disrupt operations and gather strategic intelligence.

Key Capabilities

• Exploitation of CVE-2025-8088
• In-memory DLL loading via NT system calls
• GIFTEDCROOK information stealer deployment
• Cloudflare Workers infrastructure exploitation
• RC4-encrypted C&C communication
• Dynamic DNS usage for persistence
• HTA-based infection chain

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Both Shadow-Earth-066 and Earth Dahu have demonstrated a persistent attack strategy, focusing on the same vulnerability for over a year. Their campaigns highlight the importance of patch management and software update mechanisms in defending against such threats. Notable operations include targeted attacks against Ukrainian government and defense organizations from April 2025 through mid-2026.

IOC Patterns

• Network traffic associated with Cloudflare Workers infrastructure
• In-memory DLL loading via NT system calls
• Exploitation of CVE-2025-8088 in WinRAR files
• Spear-phishing emails with malicious HTA files or Office documents
• Dynamic DNS domain generation activity
• Signs of RC4-encrypted command and control traffic

Recommended Actions

• Patch all instances of software utilizing the CVE-2025-8088 vulnerability as soon as possible.
• Monitor for signs of HTA file execution or suspicious in-memory DLL activity on endpoints.
• Implement logging and monitoring for network traffic to Cloudflare Workers infrastructure and Dynamic DNS domains.
• Enhance patch management processes to ensure timely updates across all systems, particularly for high-risk vulnerabilities.
• Use YARA rules or other signature-based detection to identify potential GIFTEDCROOK-related activity.

Suggested Tags