GENERAL_DISCOVERY: select the freshest, highest-impact current Malware & Campaign Intelligence topic by freshness + technical impact + evidence strength + real-world exploitation + defensive value.
RUN AUDIT
سجل تدقيق مستقل يربط نتيجة البحث بالأدلة والتناقضات وحالة الالتزام والـReadback والمتابعة دون استنتاج حالة غير مسجلة.
GENERAL_DISCOVERY: select the freshest, highest-impact current Malware & Campaign Intelligence topic by freshness + technical impact + evidence strength + real-world exploitation + defensive value.
NEW_TOPIC
Research result: PASS
Selected MDaemon/ClamAV zero-click RAR exploitation after candidate ranking and identity/dedupe. Verified ESET-observed Ukraine MDaemon campaign, HELLAGE/HELLTAG deployment, affected MDaemon/ClamAV path and fixed versions. Preserved campaign scale, current infrastructure and named-actor attribution as UNKNOWN/OPEN.
EVIDENCE
CONTRADICTIONS
لا توجد تناقضات مسجلة لهذه الجولة.
UNCERTAINTY
FOLLOW-UP
Public evidence does not quantify victim count, affected MDaemon server count, sector distribution or denominator of exposed vulnerable servers.
No independently corroborated specifically named actor/operator identity is established for the exact MDaemon→HELLAGE/HELLTAG chain.
Current HELLAGE/HELLTAG C2/infrastructure continuity and campaign activity after the disclosed Q2–Q3 2026 window remain unresolved.
AUDIT TIMELINE
لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.
PERSISTENCE / READBACK
COMMITTED · Readback PASS
Reconciliation source غير مسجل
Integrity: PASS · غير مسجل
Evidence 24 · Hypotheses 19 · Runs 5
Commit: PASS · Readback: PASS · Closure: PASS
PASS — ACRIP-COMMIT-MCI-7F3A9C21 COMMITTED/READBACK_PASS; Hot-Start v1.4 refreshed/read back from committed state; MCI SSOT final CLOSED/PASS. Canonical identities unique, ownership/pointers valid, 8 evidence edges non-orphan. Run package: https://docs.google.com/document/d/1HGIz9ZqgSMS7qL4t4kUpqzp1CE7tDvjnKAKj_W8BAHs/edit ; protected Core root 597ca514575a926e202096be60f1a040dd63bfbb99ae07f7bf6d061e482c6b2c unchanged.
NEW — ESET-observed MDaemon campaign and HELLAGE/HELLTAG deployment verified; affected MDaemon/ClamAV path and fixed versions independently validated; victim scale, current C2 continuity and named actor remain unresolved.