Mandiant/FireEye described multiple campaigns abusing a recently disclosed WinRAR ACE handling vulnerability. Observed payloads provided keylogging, password theft and RAT capabilities, with different malware families and varied targeting. Exploits typically wrote payloads to the Windows startup folder, but the vulnerability could write to other paths when WinRAR had sufficient permissions. The report recommends blocking vulnerable WinRAR versions, updating WinRAR, and using endpoint, email and network detections across the attack chain.