WinRAR is a widely used file-archiving utility whose vulnerabilities can turn crafted archives into code-execution or payload-delivery mechanisms. DPRK-linked SectorA activity exploited WinRAR vulnerabilities to deliver malware targeting cryptocurrency wallets and browser credentials as part of financially motivated campaigns.