---
schema: 1
kind: threat
title: "MDaemon mail server below 26.0.4 and Windows ClamAV 0.101.0 to 1.5.3: a crafted RAR emailed to any address runs code on the server through the bundled UnRAR flaw CVE-2025-8088, and ESET saw Russia-aligned attackers use it in Ukraine to deploy the HELLAGE and HELLTAG backdoors"
headline: "ESET: an emailed RAR ran code on MDaemon servers via ClamAV's UnRAR; fixed in MDaemon 26.0.4, ClamAV 1.4.6 and 1.5.4"
summary: >
  ESET reports an active campaign in Ukraine in which Russia-aligned attackers exploited MDaemon mail servers: a crafted RAR archive mailed to any address makes MDaemon invoke ClamAV, whose
  old bundled UnRAR library carries the path-traversal flaw CVE-2025-8088, and the exploit writes a malicious DLL to the server with no user interaction. MDaemon fixed it in 26.0.4 on 2026-08-25, and
  ClamAV's own notes show that every Windows ClamAV from 0.101.0 to 1.5.3 is affected, fixed in 1.4.6 and 1.5.4. The attackers deployed the HELLAGE mail-stealing backdoor and the Telegram-controlled HELLTAG backdoor.
discovered_at: "2026-10-29T04:46:00Z"
updated_at: null
event_date: "2026-10-28"
run_id: 2026-10-29T0255Z-intel
priority: notable
immediate_action: null
tags: [espionage, vulnerabilities, actively-exploited, cisa-kev, patch-available, russia-nexus]
regions: [europe]
sectors: []
entities: ["product:mdaemon-email-server", "product:clamav", "malware:hellage", "malware:helltag"]
techniques: [T1190, T1102, T1114.001]
affected_products: ["MDaemon Email Server", "ClamAV"]
cves:
  - id: CVE-2025-8088
    cvss: "n/a"
    epss: null
    type: path-traversal
    vector: zero-click
    auth: pre-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "ClamAV 0.101.0 through 1.5.3 on Windows, through its bundled UnRAR library; MDaemon mail server before 26.0.4"
    fixed: "ClamAV 1.4.6 and 1.5.4; MDaemon 26.0.4 (2026-08-25)"
sources:
  - url: "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/"
    publisher: "ESET Research"
    date: "2026-10-28"
    role: primary
  - url: "https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2026-q3-2026.pdf"
    publisher: "ESET Research (APT Activity Report, April to September 2026)"
    date: "2026-10-28"
    role: primary
  - url: "https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html"
    publisher: "ClamAV"
    date: "2026-08-07"
    role: corroborating
  - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
    publisher: "CISA Known Exploited Vulnerabilities catalog"
    date: "2026-10-28"
    role: corroborating
closed_sources: []
evidence:
  - quote: "We also identified an extensive campaign in Ukraine exploiting MDaemon mail servers, during which the attackers deployed two backdoor malware families, HELLAGE and HELLTAG."
    publisher: "ESET Research"
    source_url: "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/"
  - quote: "This issue affects ClamAV 0.101.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4."
    publisher: "ClamAV"
    source_url: "https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html"
  - quote: "The fix rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows."
    publisher: "ClamAV"
    source_url: "https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html"
verification: multi-source
sourcing_note: >
  The campaign, the MDaemon chain, the fixed MDaemon version and the backdoor descriptions are ESET's, and ESET could not attribute the campaign to a known Russia-aligned actor; the backdoor names are
  CERT-UA's as ESET relays them. ClamAV's release notes independently confirm the library flaw and its affected range, which is wider than MDaemon. No CVE for the MDaemon packaging issue and no MDaemon
  advisory were found, so the MDaemon fixed version rests on ESET alone. The KEV entry for CVE-2025-8088 is listed against WinRAR.
confidence: medium
references: ["2026-06-10/year-old-winrar-flaw-cve-2025-8088-still-fuels-ukraine-intru", "2026-06-02/sekoia-consolidates-gamaredon-tooling-under-gammaphish-gamma", "2026-06-27/turla-s-stockstay-a-four-component-net-backdoor-for-diplomat"]
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Update every MDaemon mail server to 26.0.4 or later and every Windows host that scans mail or files with ClamAV to 1.4.6 or 1.5.4, then check each mail server for DLLs it should not hold and treat stored mail on a server that ran an older build as possibly read, because HELLAGE steals email."
updates: []
migrated_from: null
---

ESET reports an active campaign in Ukraine in which Russia-aligned attackers exploited MDaemon mail servers and deployed two backdoor families, HELLAGE and HELLTAG ([ESET Research, 2026-10-28](https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/)). MDaemon uses ClamAV to scan attachments of incoming mail; old ClamAV versions carry CVE-2025-8088, the WinRAR path-traversal flaw ESET uncovered last year, which ESET says was fixed in ClamAV's source on 27 July 2025 (the release notes below date the fixed ClamAV builds 2026-08-07), while MDaemon kept shipping an old libclamunrar.dll until MDaemon 26.0.4 of 2026-08-25 ([ESET Research, 2026-10-28](https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2026-q3-2026.pdf)). The chain ESET describes: a crafted RAR archive is mailed to any address at a vulnerable server, MDaemon invokes ClamAV to scan it, and the exploit writes a malicious DLL to the server's file system with no user interaction, so the message carries no lure ([ESET Research, 2026-10-28](https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2026-q3-2026.pdf)). CERT-UA names the backdoors: HELLAGE steals email messages and other data, talks to a hardcoded server and can deploy more malware, and HELLTAG takes commands, transfers files and does reconnaissance through a hardcoded Telegram bot; ESET cannot attribute the campaign to a known Russia-aligned actor ([ESET Research, 2026-10-28](https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2026-q3-2026.pdf)).

The exposure is wider than MDaemon. ClamAV's release notes of 2026-08-07 say it adopted the upstream UnRAR fix for CVE-2025-8088, which rejects path separators in NTFS alternate data stream names so that extraction cannot leave ClamAV's temporary scan directory on Windows, and that the issue affects ClamAV 0.101.0 through 1.5.3 with the fix in 1.4.6 and 1.5.4 ([ClamAV, 2026-08-07](https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html)). CISA has listed CVE-2025-8088 in its Known Exploited Vulnerabilities catalog since 2025-08-12 ([CISA KEV, 2026-10-28](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)).

**Exposure:** an MDaemon server on Windows below 26.0.4 that accepts inbound mail ([ESET Research, 2026-10-28](https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2026-q3-2026.pdf)), and any other Windows host that scans mail or files with ClamAV 0.101.0 to 1.5.3 ([ClamAV, 2026-08-07](https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html)).

**Detection:** because the attack needs no lure, the mail log shows an ordinary message with a RAR attachment. The telemetry that matters is file creation of a DLL by the ClamAV or mail-service scanning process outside ClamAV's temporary scan directory, inbound RAR attachments whose member names carry alternate-data-stream syntax with path separators, and the mail service process starting unexpected children or connecting to Telegram's bot interface; these follow from the described chain and are not an ESET detection list. An update does not remove a DLL or backdoor that was already written, so check the server after patching.

**Defender takeaway:** patch the mail scanning path first on any internet-facing Windows mail server, then look for unexpected DLLs and persistence and treat stored mail as exposed, since HELLAGE steals email ([ESET Research, 2026-10-28](https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2026-q3-2026.pdf)).