Google Threat Intelligence Group

Google Warns of Widespread, Ongoing Exploitation of WinRAR Vulnerability

Attackers use ADS-based archives to drop files into Windows Startup on unpatched systems, enabling quiet persistence.