Russia-aligned actors exploit MDaemon's outdated ClamAV library (CVE-2025-8088) for zero-click backdoor installs in Ukraine
ESET's APT Activity Report for Q2–Q3 2026 describes an active campaign in Ukraine in which Russia-aligned actors gain code execution on MDaemon mail servers with no user interaction. ESET could not attribute the activity to a known Russia-aligned group. The attackers email a crafted RAR archive to any address on a vulnerable server, and MDaemon's own ClamAV attachment scan triggers the exploit. CERT-UA tracks the two malware families used as HELLAGE and HELLTAG. MDaemon fixed the issue on 25 August 2026 in version 26.0.4.
Entenda a falha
A vulnerabilidade
CVE-2025-8088 is a WinRAR path traversal bug that also affects the RAR handling in ClamAV (libclamunrar.dll). MDaemon mail server bundles ClamAV to scan attachments and kept shipping an outdated copy of the library. An attacker only needs to email a crafted RAR archive to any address on a vulnerable server. No authentication or user interaction is needed, and the result is a malicious DLL written to the mail server's file system, leading to code execution. MDaemon versions before 26.0.4 are affected, and 26.0.4 is the fix. The fixed ClamAV builds are 1.4.6 and 1.5.4.
Como funciona
An email with a RAR attachment arrives at any mailbox on the MDaemon server. MDaemon passes the attachment to ClamAV for scanning, and ClamAV uses libclamunrar.dll to open the archive. With the outdated library, the path traversal in the archive handling fires during that scan and writes a malicious DLL to the server's file system. Nobody has to open the message, because the server's own scanning process runs the exploit.
Por que é vulnerável
The root cause is path traversal in how RAR archives are extracted, which lets a crafted archive place files outside the intended directory. ClamAV fixed it on 27 July 2025, but MDaemon kept shipping an outdated libclamunrar.dll, so the fix never reached its users for about a year. The articles do not describe the code-level change. The fix is to ship the updated ClamAV libraries, which MDaemon did in 26.0.4 on 25 August 2026.
Onde está
The articles name the outdated libclamunrar.dll library bundled with MDaemon's ClamAV; no function or commit is named.
Como foi descoberta
ESET discovered the underlying WinRAR flaw CVE-2025-8088 last year. The MDaemon exploitation appears in ESET's APT Activity Report for Q2–Q3 2026, which describes an active campaign in Ukraine by Russia-aligned actors that ESET could not attribute to a known group. CERT-UA tracks the two malware families used as HELLAGE and HELLTAG. The articles do not say how the MDaemon issue was reported to the vendor. MDaemon fixed it on 25 August 2026.
Explicação gerada por IA a partir da matéria e dos artigos, em 31/10/2026 04:16.
Detalhes técnicos
- Flaw: CVE-2025-8088, a WinRAR path traversal bug discovered by ESET. ClamAV fixed it on 27 July 2025, but MDaemon kept shipping an outdated libclamunrar.dll.
- Chain: malicious RAR sent to any mailbox on the server, MDaemon invokes ClamAV to scan the attachment, the exploit fires and writes a malicious DLL to the mail server file system. No lure is needed because the scanning process runs the exploit.
- Context: Russian groups continue to abuse the same bug in Russia-aligned WinRAR attacks against Ukraine. Earlier Russian campaigns used webmail flaws to steal credentials and 2FA secrets.
- Affected: MDaemon releases before 26.0.4 that ship the old ClamAV library. Fixed ClamAV builds are 1.4.6 and 1.5.4.
Remediação
- Upgrade MDaemon to 26.0.4 or later and confirm the bundled ClamAV libraries, including libclamunrar.dll, are updated.
- Review the mail server file system for unexpected DLLs outside normal directories.
- Hunt for outbound connections to unknown C&C servers and for Telegram bot API traffic from the mail server.
- Audit mailboxes for unauthorized access or bulk message exfiltration, and restrict outbound internet access from mail servers.
- Organizations in Ukraine and across Europe should treat unpatched MDaemon servers as potentially compromised.
Linha do tempo
-
Russia-aligned actors exploit MDaemon's outdated ClamAV library (CVE-2025-8088) for zero-click backdoor installs in Ukraine
ler a análise desta fonte ocultar
ESET's APT Activity Report for Q2–Q3 2026 describes an active campaign in Ukraine in which Russia-aligned actors gain code execution on MDaemon mail servers with no user interaction. ESET could not attribute the activity to a known Russia-aligned group. The attackers email a crafted RAR archive to any address on a vulnerable server, and MDaemon's own ClamAV attachment scan triggers the exploit. CERT-UA tracks the two malware families used as HELLAGE and HELLTAG. MDaemon fixed the issue on 25 August 2026 in version 26.0.4.
Technical Details
- Flaw: CVE-2025-8088, a WinRAR path traversal bug discovered by ESET. ClamAV fixed it on 27 July 2025, but MDaemon kept shipping an outdated libclamunrar.dll.
- Chain: malicious RAR sent to any mailbox on the server, MDaemon invokes ClamAV to scan the attachment, the exploit fires and writes a malicious DLL to the mail server file system. No lure is needed because the scanning process runs the exploit.
- Context: Russian groups continue to abuse the same bug in Russia-aligned WinRAR attacks against Ukraine. Earlier Russian campaigns used webmail flaws to steal credentials and 2FA secrets.
- Affected: MDaemon releases before 26.0.4 that ship the old ClamAV library. Fixed ClamAV builds are 1.4.6 and 1.5.4.
Remediation
- Upgrade MDaemon to 26.0.4 or later and confirm the bundled ClamAV libraries, including libclamunrar.dll, are updated.
- Review the mail server file system for unexpected DLLs outside normal directories.
- Hunt for outbound connections to unknown C&C servers and for Telegram bot API traffic from the mail server.
- Audit mailboxes for unauthorized access or bulk message exfiltration, and restrict outbound internet access from mail servers.
- Organizations in Ukraine and across Europe should treat unpatched MDaemon servers as potentially compromised.