Russia-aligned actors exploit MDaemon flaw to plant backdoors with no clicks
Original title: Russian Hackers Exploit MDaemon Mail Server Flaw to Install Backdoors Without User Interaction
ESET says MDaemon before 26.0.4 runs CVE-2025-8088 while scanning a malicious RAR, dropping HELLAGE or HELLTAG DLLs in Ukraine.
ESET’s APT Activity Report for Q2–Q3 2026 describes an active Ukraine campaign in which Russia-aligned actors email a crafted RAR to any address on a vulnerable MDaemon server. The server’s bundled, outdated ClamAV library triggers CVE-2025-8088 during attachment scanning and writes a malicious DLL, with no user opening the message. ESET could not tie the activity to a named group. MDaemon fixed the issue in 26.0.4 on August 25, 2026; CERT-UA tracks the payloads as HELLAGE and HELLTAG.
Unconfirmed: ESET could not attribute the campaign to a known Russia-aligned group.
- CVE-2025-8088 is a WinRAR path traversal that ClamAV fixed on July 27, 2025.
- MDaemon before 26.0.4 still shipped the outdated libclamunrar.dll.
- Fixed ClamAV builds named in the report are 1.4.6 and 1.5.4.
- CERT-UA tracks the campaign malware as HELLAGE and HELLTAG.
- ESET says the same bug is reused in other Russia-aligned WinRAR attacks on Ukraine.
Impact: Remote code execution that writes a backdoor DLL on the mail server
| Product | Affected | Fixed in |
|---|---|---|
| MDaemon | releases before 26.0.4 that ship the old ClamAV library | 26.0.4 |
| ClamAV | old versions shipping vulnerable libclamunrar.dll | 1.4.6 and 1.5.4 |
- 1.Upgrade MDaemon to 26.0.4 or later and confirm libclamunrar.dll is updated.
- 2.Review the mail server file system for unexpected DLLs outside normal directories.
- 3.Hunt for unknown C&C connections and Telegram bot API traffic from the mail server.
- CVEs
- CVE-2025-8088
- Products
- WinRAR
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
From the original article
2 min read at gbhackers.com
Russia-aligned threat actors are exploiting a flaw in MDaemon mail server software to run code on the server. Victims don’t have to open or click anything. ESET’s APT Activity Report for Q2–Q3 2026 describes an active campaign in Ukraine.
By Kavichselvan · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.