Threat reportVulnerabilityTL-2026-4883
Russia-aligned actors exploit CVE-2025-8088 (WinRAR path traversal in ClamAV's bundled UnRAR) via MDaemon mail server scanning to drop HELLAGE/HELLTAG backdoors without user interaction
Russia-aligned actors exploit CVE-2025-8088 (WinRAR path (TL-2026-4883), also tracked as MDaemon ClamAV RAR zero-click exploitation, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-10-31. It is linked to a Russia-nexus actor with low confidence, affects Alt-N Technologies MDaemon Email Server, references 1 CVE (CVE-2025-8088), maps to 5 MITRE ATT&CK techniques (T1071.001, T1114, T1190), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4883
- Threat ID
- TL-2026-4883
- Also known as
- MDaemon ClamAV RAR zero-click exploitation
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, military
- Target regions
- ukraine, Europe
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Russia-aligned actors exploit CVE-2025-8088 (WinRAR path
Malware and tooling: HELLAGE, HELLTAG
How Russia-aligned actors exploit CVE-2025-8088 (WinRAR path works
ESET's APT Activity Report Q2-Q3 2026 documents a Ukraine campaign in which Russia-aligned actors email malicious RAR archives to MDaemon servers; the server's automatic ClamAV scan triggers CVE-2025-8088 and writes a malicious DLL to disk with no user interaction. The backdoors are tracked as HELLAGE and HELLTAG; MDaemon 26.0.4 and ClamAV 1.4.6/1.5.4 fix the flaw.
CVE-2025-8088 is a path traversal flaw (NVD: CWE-35) originally reported in the Windows edition of WinRAR up to and including 7.12, discovered by ESET researchers Anton Cherepanov, Peter Kosinar and Peter Strycek. It was added to the CISA KEV catalog on 2025-08-12. The same flaw exists in the UnRAR code bundled in ClamAV (libclamunrar). ClamAV 1.4.5 and 1.5.3 are affected; the fix adopts the upstream UnRAR change that rejects path separators in NTFS alternate data stream names, so extraction cannot escape ClamAV's temporary scan directory on Windows. The fix shipped in ClamAV 1.4.6 and 1.5.4 (1.5.4 released 2026-08-07).
MDaemon is a Windows mail server that bundles ClamAV for attachment scanning. Per ESET's Q2-Q3 2026 APT Activity Report (published 2026-10-28) as summarized by GBHackers (2026-10-31), Russia-aligned actors sent a crafted RAR archive to an address on a vulnerable MDaemon server. MDaemon invoked ClamAV on the attachment, the exploit triggered during the scan, and a malicious DLL was written to the mail server filesystem. The victim does not need to open or click anything. ESET describes this as part of an extensive campaign in Ukraine that deployed two backdoor families, HELLAGE and HELLTAG, both tracked by CERT-UA. No specific group is named in the sources reviewed.
The campaign matches ESET's wider finding that Ukraine was targeted significantly more by Russia-aligned groups in Q2-Q3 2026. MDaemon 26.0.4, released 2026-08-25, ships a fixed ClamAV. Detection guidance in the source: hunt the mail server filesystem for unexpected DLLs, watch for outbound C2 connections and Telegram bot API traffic, audit mailboxes for unauthorized access or exfiltration, and restrict the mail server's outbound internet access. The sources list no network IOCs, file hashes or DLL names, and CVSS for the MDaemon abuse is not separately scored. The NVD CVSS v3.1 score of 8.8 and the CNA (ESET) v3.1 score of 8.4 are inherited from the WinRAR/ClamAV CVE entries. Note: GBHackers gives a ClamAV fix date of 2025-07-27, which conflicts with ClamAV 1.5.4 release coverage (2026-08-07); this record uses the latter.
MITRE ATT&CK techniques used in TL-2026-4883
Command and Control
Collection
Initial Access
T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment
Execution
Affected products and versions in Russia-aligned actors exploit CVE-2025-8088 (WinRAR path
- Alt-N Technologies — MDaemon Email Server
Vulnerable versions: versions before 26.0.4
Fixed in: 26.0.4 - Cisco Talos — ClamAV (bundled UnRAR, Windows)
Vulnerable versions: 1.4.5; 1.5.3
Fixed in: 1.4.6; 1.5.4 - RARLAB — WinRAR (Windows)
Vulnerable versions: up to and including 7.12
Remediation for Russia-aligned actors exploit CVE-2025-8088 (WinRAR path
Patches
- MDaemon 26.0.4 (released 2026-08-25)
- ClamAV 1.5.4 and 1.4.6
- Distribution ClamAV updates (for example SUSE advisories published September 2026)
Immediate actions
- Upgrade MDaemon to 26.0.4 or later
- Verify the ClamAV libraries bundled with MDaemon are updated (ClamAV 1.4.6 / 1.5.4 or later)
- Hunt the mail server filesystem for unexpected DLLs written outside expected paths
- Monitor and block outbound C2 connections and Telegram bot API traffic from the mail server
- Audit mailboxes for unauthorized access and exfiltration
Workarounds
- Reject or quarantine RAR attachments at an upstream gateway until patched
- Disable RAR scanning in the ClamAV integration if supported
Longer-term hardening
- Restrict mail server outbound internet access to required destinations only
- Run attachment scanning with least privilege and in a sandboxed context
- Alert on file writes by the scanner process outside its temporary scan directory
CVEs associated with Russia-aligned actors exploit CVE-2025-8088 (WinRAR path
Weaknesses (CWE) in Russia-aligned actors exploit CVE-2025-8088 (WinRAR path
Timeline of Russia-aligned actors exploit CVE-2025-8088 (WinRAR path
- CVE-2025-8088 (WinRAR path traversal, discovered by ESET) published in NVD, CVSS v3.1 8.8
- CVE-2025-8088 added to the CISA Known Exploited Vulnerabilities catalog (mitigation deadline 2025-09-02)
- ESET reporting window opens (April 2026); the MDaemon/ClamAV campaign in Ukraine occurred during Q2-Q3 2026
- ClamAV 1.5.4 and 1.4.6 released, fixing CVE-2025-8088 in the bundled UnRAR library
- MDaemon 26.0.4 released with fixed ClamAV; SUSE CVE page for CVE-2025-8088 created the same day
- ESET reporting window closes (end of September 2026)
- ESET publishes APT Activity Report Q2 2026 - Q3 2026 documenting HELLAGE and HELLTAG deployment via MDaemon
- GBHackers reports the zero-interaction MDaemon exploitation campaign
Sources cited for Russia-aligned actors exploit CVE-2025-8088 (WinRAR path
- Russian Hackers Exploit MDaemon Mail Server Flaw to Install Backdoors Without User Interaction
- ESET APT Activity Report Q2 2026 - Q3 2026
- ESET APT Activity Report Q2 2026 - Q3 2026 (PDF)
- NVD - CVE-2025-8088
- CISA Known Exploited Vulnerabilities Catalog (CVE-2025-8088)
- SUSE - CVE-2025-8088 upstream information
- ClamAV 1.5.4 Open-Source Antivirus Fixes Eight Security Vulnerabilities
- ClamAV releases (Cisco-Talos/clamav)
- Ubuntu USN-8788-1: ClamAV vulnerabilities
Detection coverage for TL-2026-4883
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4883 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.