CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

HELLTAG

malware · malware:helltag

Backdoor that CERT-UA names, as ESET relays it, for a campaign against MDaemon mail servers in Ukraine: it takes commands, transfers files and does reconnaissance through a hardcoded Telegram bot (ESET Research, 2026-10-28).

Coverage
1
first 2026-10-29 → last 2026-10-29
Latest activity
2026-10-29
ESET: an emailed RAR ran code on MDaemon servers via ClamAV's UnRAR; fixed in MDaemon 26.0.4, ClamAV 1.4.6…
Peak priority
notable
1 notable
Targets
·
regions: europe
Sources cited
4
4 hosts

Action items (1)

Do-now tasks recorded on the entries about HELLTAG, newest first. Check the date before acting on an older one.

  • Update every MDaemon mail server to 26.0.4 or later and every Windows host that scans mail or files with ClamAV to 1.4.6 or 1.5.4, then check each mail server for DLLs it should not hold and treat stored mail on a server that ran an older build as possibly read, because HELLAGE steals email.
    2026-10-29CVE-2025-8088

Defender insights

What each entry about HELLTAG tells a defender to do, newest first.

2026-10-29NOTABLEexploitedESET: an emailed RAR ran code on MDaemon servers via ClamAV's UnRAR; fixed in MDaemon 26.0.4, ClamAV 1.4.6 and 1.5.4

Exposure · detection

Story timeline

  1. 2026-10-29MDaemon mail server below 26.0.4 and Windows ClamAV 0.101.0 to 1.5.3: a crafted RAR emailed to any address runs code on the server through the bundled UnRAR flaw CVE-2025-8088, and ESET saw Russia-aligned attackers use it in Ukraine to deploy the HELLAGE and HELLTAG backdoors
    active-threatsESET: an emailed RAR ran code on MDaemon servers via ClamAV's UnRAR; fixed in MDaemon 26.0.4, ClamAV 1.4.6 and 1.5.4

Hunting pivots

CVEs (exploited first)
CVE-2025-8088
Affected products
ClamAVMDaemon Email Server
Tags
actively-exploitedcisa-kevespionagepatch-availablerussia-nexusvulnerabilities
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • CollectionEmail Collection: Local Email Collection
  • Command and ControlWeb Service

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-29/mdaemon-clamav-unrar-cve-2025-8088-exploited-in-ukraine · ATT&CK page ↗

Collection TA0009

T1114.001Email Collection: Local Email Collection×1

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.

Evidence: 2026-10-29/mdaemon-clamav-unrar-cve-2025-8088-exploited-in-ukraine · ATT&CK page ↗

Command and Control TA0011

T1102Web Service×1

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Evidence: 2026-10-29/mdaemon-clamav-unrar-cve-2025-8088-exploited-in-ukraine · ATT&CK page ↗

Entries about HELLTAG (1)

2026-10-29 · view entry permalink →

NOTABLECVE-2025-8088exploitedNATOB2

MDaemon mail server below 26.0.4 and Windows ClamAV 0.101.0 to 1.5.3: a crafted RAR emailed to any address runs code on the server through the bundled UnRAR flaw CVE-2025-8088, and ESET saw Russia-aligned attackers use it in Ukraine to deploy the HELLAGE and HELLTAG backdoors

ESET reports an active campaign in Ukraine in which Russia-aligned attackers exploited MDaemon mail servers and deployed two backdoor families, HELLAGE and HELLTAG (ESET Research, 2026-10-28). MDaemon uses ClamAV to scan attachments of incoming mail; old ClamAV versions carry CVE-2025-8088, the WinRAR path-traversal flaw ESET uncovered last year, which ESET says was fixed in ClamAV's source on 27 July 2025 (the release notes below date the fixed ClamAV builds 2026-08-07), while MDaemon kept shipping an old libclamunrar.dll until MDaemon 26.0.4 of 2026-08-25 (ESET Research, 2026-10-28). The chain ESET describes: a crafted RAR archive is mailed to any address at a vulnerable server, MDaemon invokes ClamAV to scan it, and the exploit writes a malicious DLL to the server's file system with no user interaction, so the message carries no lure (ESET Research, 2026-10-28). CERT-UA names the backdoors: HELLAGE steals email messages and other data, talks to a hardcoded server and can deploy more malware, and HELLTAG takes commands, transfers files and does reconnaissance through a hardcoded Telegram bot; ESET cannot attribute the campaign to a known Russia-aligned actor (ESET Research, 2026-10-28).

The exposure is wider than MDaemon. ClamAV's release notes of 2026-08-07 say it adopted the upstream UnRAR fix for CVE-2025-8088, which rejects path separators in NTFS alternate data stream names so that extraction cannot leave ClamAV's temporary scan directory on Windows, and that the issue affects ClamAV 0.101.0 through 1.5.3 with the fix in 1.4.6 and 1.5.4 (ClamAV, 2026-08-07). CISA has listed CVE-2025-8088 in its Known Exploited Vulnerabilities catalog since 2025-08-12 (CISA KEV, 2026-10-28).

We also identified an extensive campaign in Ukraine exploiting MDaemon mail servers, during which the attackers deployed two backdoor malware families, HELLAGE and HELLTAG.

ESET Research 2026-10-28

This issue affects ClamAV 0.101.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

The fix rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

ClamAV 2026-08-07

Builds on: Year-old WinRAR flaw (CVE-2025-8088) still fuels Ukraine intrusions: GIFTEDCROOK via UAC-0226… · Sekoia consolidates Gamaredon tooling under GammaPhish / GammaWorm, details an NTFS-ADS… · Turla's STOCKSTAY: a four-component .NET backdoor for diplomatic intelligence collection

threat29 Oct 04:46Zmulti-sourceOpen finding →
Sources: ESET Research · ESET Research (APT Activity Report, April to September 2026) · ClamAV · CISA Known Exploited Vulnerabilities catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • blog.clamav.net1 (25%)
  • cisa.gov1 (25%)
  • web-assets.esetstatic.com1 (25%)
  • welivesecurity.com1 (25%)
All cited sources (4)