Immediate digital threats are still all around us and target the most valuable — our data. The talk showed that fresh attacks can bypass even modern tools and hit Windows, macOS, and Linux. Using the example of the Turla group exploiting a vulnerability in WinRAR, it became clear why it is hard to defend against “one‑day” threats.
The Turla case and a vulnerability in WinRAR
As a model example, an attack was presented that the pro‑Russian group Turla used during Russia’s war against Ukraine. The attackers exploited a vulnerability in the WinRAR application to obtain victims’ login credentials via phishing. An advantage for them is the widespread use of such software across platforms.
The attack could come via e‑mail or through a visited page on the web gateway, or the malicious installer could reach the endpoint via USB. Victims often launched software that appeared legitimate — except it was a modified, compromised version. Packages prepared in this way could be installed without immediate warning, which opened a path to the data for the attackers.
How the defensive tools fared
In the demonstration they compared the response of various solutions. An unspecified premium EDR protected the workstation only about 50%: it did not block access to malicious sites via the web gateway, but at least stopped some attempts after download and execution. By contrast, Microsoft Defender on Windows 10 did not detect the links at the web gateway and also allowed the installation to run on the endpoint.
The result was the “worst‑case scenario,” in which all attack vectors could be used. The point was clear: it’s easy to block threats with old signatures, but fresh, one‑day to two‑day techniques pose a fundamental challenge. The demo reminded us that threats are immediate and it’s worth verifying protection against real, up‑to‑date scenarios.