TOPIC
Server-side MDaemon/ClamAV RAR exploitation enabling no-recipient-interaction compromise and HELLAGE/HELLTAG deployment in Ukraine; separates vulnerability mechanism, observed campaign, scale, current infrastructure and actor attribution.
1
5
3
3
3
NEW — ESET-observed MDaemon campaign and HELLAGE/HELLTAG deployment verified; affected MDaemon/ClamAV path and fixed versions independently validated; victim scale, current C2 continuity and named actor remain unresolved.
MALWARE_CAMPAIGN_RESEARCH_TOPIC
—
—
—
The MDaemon campaign is a real server-side malware-delivery chain in which automatic attachment scanning can trigger exploitation and backdoor deployment without recipient interaction.
Independent IR telemetry or additional primary victim evidence.
Vulnerable MDaemon deployments using affected bundled ClamAV/UnRAR versions require patching plus post-compromise hunting; patch completion alone cannot establish absence of prior compromise.
Server-specific forensic artifacts, exposure windows and historical telemetry.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 5 Evidence
ESET reported an extensive campaign in Ukraine exploiting MDaemon mail servers and deploying HELLAGE and HELLTAG.
لا يثبت: Does not establish public victim/server count, current infrastructure continuity, or a specifically named operator.
فتح Run المصدرMDaemon confirms CVE-2025-8088 affects its Windows ClamAV integration: processing a malicious RAR can extract files outside ClamAV's temporary scan directory; MDaemon 26.0.4+ contains remediated ClamAV.
لا يثبت: Does not independently prove the Ukraine campaign, victim count, HELLAGE/HELLTAG identity or actor attribution.
فتح Run المصدرClamAV states CVE-2025-8088 affected versions 0.101.0 through 1.5.3 and is fixed in 1.4.6/1.5.4; the fix rejects path separators in NTFS alternate-data-stream names in bundled UnRAR handling.
لا يثبت: Does not independently prove exploitation against MDaemon, HELLAGE/HELLTAG, victim scale or actor identity.
فتح Run المصدرMDaemon 26.0.4, released 2026-08-25, updated the bundled ClamAV engine to 1.4.6.
لا يثبت: Does not prove a particular deployment was exposed or compromised.
فتح Run المصدرThe underlying CVE-2025-8088 path-traversal vulnerability is documented as exploited in the wild and present in CISA KEV.
لا يثبت: Does not independently prove that the specific 2026 MDaemon/HELLAGE/HELLTAG campaign used the flaw.
فتح Run المصدرA single specifically identifiable Russia-aligned group can be attributed as operator of the observed HELLAGE/HELLTAG MDaemon campaign.
Actor-linked infrastructure, handles, malware provenance or independent authoritative attribution.
Public evidence does not quantify victim count, affected MDaemon server count, sector distribution or denominator of exposed vulnerable servers.
Independent IR/provider telemetry, affected-organization disclosures, exposure measurements and normalized server denominator.
No independently corroborated specifically named actor/operator identity is established for the exact MDaemon→HELLAGE/HELLTAG chain.
Actor-linked infrastructure, malware lineage, stable handles, operational overlap or authoritative independent attribution.
Current HELLAGE/HELLTAG C2/infrastructure continuity and campaign activity after the disclosed Q2–Q3 2026 window remain unresolved.
Fresh passive DNS/hosting telemetry, new incident artifacts, current C2 observations or authoritative follow-up reporting.
CURRENT_INFRASTRUCTURE