Russia-aligned actors exploit MDaemon flaw to plant backdoors with no clicks
ESET says MDaemon before 26.0.4 runs CVE-2025-8088 while scanning a malicious RAR, dropping HELLAGE or HELLTAG DLLs in Ukraine.
Stories per day · 30 days
2 RSS
Relatedantivirus1command-and-control1evasion1hellage1keylogging1malware-detection1mdaemon1nik-c21openai1path-traversal1ransomware1signatures1ukraine1winrar1
7 stories, newest first · one card per story
Stories tagged #clamav
Talos finds NIK C2 Windows implant that spends victims' OpenAI keys
The Go implant dumps credentials, captures keystrokes, and can lock screens with ransomware while calling an OpenAI model on the host.
1
Paper proposes shielding antivirus signatures from black-box extraction
On a ClamAV prototype, Robust Embedding Matching raised probing queries by up to 282.57 times with under 0.1% added false positives.
USN-8788-1: ClamAV vulnerabilities
ClamAV contains multiple denial-of-service vulnerabilities allowing remote crashes via crafted archive and document files.
ClamAV Vulnerabilities Affecting Cisco Products: August 2026
Cisco patched ClamAV vulnerabilities that allow remote attackers to cause denial-of-service conditions, rated High only for Windows-based platforms.
ZDI-26-583: Clam AntiVirus 7z Archive Parsing Integer Overflow Remote Code Execution Vulnerability
Zero Day Initiative discloses CVE-2026-20215, an integer overflow in ClamAV's 7z archive parsing enabling remote code execution, rated CVSS 8.4.
Cisco Warns of Seven ClamAV Flaws, Two With Public PoCs
Cisco warns of seven ClamAV denial-of-service flaws in Secure Endpoint Connector, two with public PoCs; patches due in August.