MDaemon/ClamAV Zero-Click RAR Exploitation — HELLAGE/HELLTAG Backdoors in Ukraine
Status
PASS
Verified Findings
None
Contradictions / Caveats
UNKNOWN: ESET reported an extensive campaign in Ukraine exploiting MDaemon mail servers and deploying HELLAGE and HELLTAG.
Evidence boundary: Does not establish public victim/server count, current infrastructure continuity, or a specifically named operator.
UNKNOWN: MDaemon confirms CVE-2025-8088 affects its Windows ClamAV integration: processing a malicious RAR can extract files outside ClamAV's temporary scan directory; MDaemon 26.0.4+ contains remediated ClamAV.
Evidence boundary: Does not independently prove the Ukraine campaign, victim count, HELLAGE/HELLTAG identity or actor attribution.
UNKNOWN: ClamAV states CVE-2025-8088 affected versions 0.101.0 through 1.5.3 and is fixed in 1.4.6/1.5.4; the fix rejects path separators in NTFS alternate-data-stream names in bundled UnRAR handling.
Evidence boundary: Does not independently prove exploitation against MDaemon, HELLAGE/HELLTAG, victim scale or actor identity.
UNKNOWN: MDaemon 26.0.4, released 2026-08-25, updated the bundled ClamAV engine to 1.4.6.
Evidence boundary: Does not prove a particular deployment was exposed or compromised.
UNKNOWN: The underlying CVE-2025-8088 path-traversal vulnerability is documented as exploited in the wild and present in CISA KEV.
Evidence boundary: Does not independently prove that the specific 2026 MDaemon/HELLAGE/HELLTAG campaign used the flaw.
Open Follow-up
OPEN [HIGH]: CAMPAIGN_SCALE — Public evidence does not quantify victim count, affected MDaemon server count, sector distribution or denominator of exposed vulnerable servers.
OPEN [HIGH]: ACTOR_ATTRIBUTION — No independently corroborated specifically named actor/operator identity is established for the exact MDaemon→HELLAGE/HELLTAG chain.
OPEN [MEDIUM-HIGH]: CURRENT_INFRASTRUCTURE — Current HELLAGE/HELLTAG C2/infrastructure continuity and campaign activity after the disclosed Q2–Q3 2026 window remain unresolved.
Sources
ESET Researchhttps://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/