State-sponsored hackers exploit WinRAR flaw