UN Panel of Experts S/2024/215
WinRAR vulnerability (CVE-2023-38831) attack on the cryptocurrency industry
Para 184: “ScarCruft exploited a WinRAR software vulnerability (CVE-2023-38831) to launch its reportedly first-ever identified attack on the cryptocurrency industry. ScarCruft reportedly used a malicious payload disguised as a cryptocurrency wallet screenshot to deliver a payload (see figure XXIX). Once malicious ZIP files were extracted and executed, the malware can allow threat actors to withdraw money from victims’ accounts.”