ESET discovers a Russian hacking group exploiting the vulnerability to deliver malware through phishing emails. WinRAR patched it, but it's up to users to install version 7.13.