MDaemon mail server below 26.0.4 and Windows ClamAV 0.101.0 to 1.5.3: a crafted RAR emailed to any address runs code on the server through the bundled UnRAR flaw CVE-2025-8088, and ESET saw Russia-aligned attackers use it in Ukraine to deploy the HELLAGE and HELLTAG backdoors
ESET: an emailed RAR ran code on MDaemon servers via ClamAV's UnRAR; fixed in MDaemon 26.0.4, ClamAV 1.4.6 and 1.5.4
Defender actions
- Update every MDaemon mail server to 26.0.4 or later and every Windows host that scans mail or files with ClamAV to 1.4.6 or 1.5.4, then check each mail server for DLLs it should not hold and treat stored mail on a server that ran an older build as possibly read, because HELLAGE steals email.
Analysis
ESET reports an active campaign in Ukraine in which Russia-aligned attackers exploited MDaemon mail servers and deployed two backdoor families, HELLAGE and HELLTAG (ESET Research, 2026-10-28). MDaemon uses ClamAV to scan attachments of incoming mail; old ClamAV versions carry CVE-2025-8088, the WinRAR path-traversal flaw ESET uncovered last year, which ESET says was fixed in ClamAV's source on 27 July 2025 (the release notes below date the fixed ClamAV builds 2026-08-07), while MDaemon kept shipping an old libclamunrar.dll until MDaemon 26.0.4 of 2026-08-25 (ESET Research, 2026-10-28). The chain ESET describes: a crafted RAR archive is mailed to any address at a vulnerable server, MDaemon invokes ClamAV to scan it, and the exploit writes a malicious DLL to the server's file system with no user interaction, so the message carries no lure (ESET Research, 2026-10-28). CERT-UA names the backdoors: HELLAGE steals email messages and other data, talks to a hardcoded server and can deploy more malware, and HELLTAG takes commands, transfers files and does reconnaissance through a hardcoded Telegram bot; ESET cannot attribute the campaign to a known Russia-aligned actor (ESET Research, 2026-10-28).
The exposure is wider than MDaemon. ClamAV's release notes of 2026-08-07 say it adopted the upstream UnRAR fix for CVE-2025-8088, which rejects path separators in NTFS alternate data stream names so that extraction cannot leave ClamAV's temporary scan directory on Windows, and that the issue affects ClamAV 0.101.0 through 1.5.3 with the fix in 1.4.6 and 1.5.4 (ClamAV, 2026-08-07). CISA has listed CVE-2025-8088 in its Known Exploited Vulnerabilities catalog since 2025-08-12 (CISA KEV, 2026-10-28).
Cited evidence
We also identified an extensive campaign in Ukraine exploiting MDaemon mail servers, during which the attackers deployed two backdoor malware families, HELLAGE and HELLTAG.
This issue affects ClamAV 0.101.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.
The fix rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.