KNOWN EXPLOITED VULNERABILITY DOSSIER
CVE-2023-38831
RARLAB · WinRAR
File extension spoofing and arbitrary code execution flaw triggered when attempting to view benign files within a ZIP archive.
Correlated Federal Court Cases & Exploitation Context (1)
Docket 2:24-cr-00330 · U.S. District Court for the District of New Jersey
U.S. v. Khoroshev et al. (LockBit Ransomware Operation) Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.
Exploitation Ground Zero: Exploitation of perimeter gateway vulnerabilities (such as Citrix Bleed CVE-2023-4966) and acquisition of compromised corporate VPN logins from Initial Access Brokers (IABs).
Operational Impact: Over 2,500 organizations breached worldwide across 120 countries, including Boeing, the UK Royal Mail, hospitals, and emergency dispatch centers. Extorted more than $500 million in ransom payments before an international coalition of 10 law enforcement agencies seized the infrastructure under Operation Cronos.
Sector: Healthcare, Education, Manufacturing, Government, Financial Services · Loss: $500.0 million
Inspect Full Case Dossier →
Associated Government Advisories
- AA23-271A CISA Alert →