# Russia-aligned actors exploit CVE-2025-8088 (WinRAR path traversal in ClamAV's bundled UnRAR) via MDaemon mail server scanning to drop HELLAGE/HELLTAG backdoors without user interaction

> ESET's APT Activity Report Q2-Q3 2026 documents a Ukraine campaign in which Russia-aligned actors email malicious RAR archives to MDaemon servers; the server's automatic ClamAV scan triggers CVE-2025-8088 and writes a malicious DLL to disk with no user interaction. The backdoors are tracked as HELLAGE and HELLTAG; MDaemon 26.0.4 and ClamAV 1.4.6/1.5.4 fix the flaw.

- **Published:** 2026-10-31T05:51:06Z
- **Last reviewed:** 2026-10-31T05:51:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4883
- **ID:** TL-2026-4883
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-8088

## Description

CVE-2025-8088 is a path traversal flaw (NVD: CWE-35) originally reported in the Windows edition of WinRAR up to and including 7.12, discovered by ESET researchers Anton Cherepanov, Peter Kosinar and Peter Strycek. It was added to the CISA KEV catalog on 2025-08-12. The same flaw exists in the UnRAR code bundled in ClamAV (libclamunrar). ClamAV 1.4.5 and 1.5.3 are affected; the fix adopts the upstream UnRAR change that rejects path separators in NTFS alternate data stream names, so extraction cannot escape ClamAV's temporary scan directory on Windows. The fix shipped in ClamAV 1.4.6 and 1.5.4 (1.5.4 released 2026-08-07).

MDaemon is a Windows mail server that bundles ClamAV for attachment scanning. Per ESET's Q2-Q3 2026 APT Activity Report (published 2026-10-28) as summarized by GBHackers (2026-10-31), Russia-aligned actors sent a crafted RAR archive to an address on a vulnerable MDaemon server. MDaemon invoked ClamAV on the attachment, the exploit triggered during the scan, and a malicious DLL was written to the mail server filesystem. The victim does not need to open or click anything. ESET describes this as part of an extensive campaign in Ukraine that deployed two backdoor families, HELLAGE and HELLTAG, both tracked by CERT-UA. No specific group is named in the sources reviewed.

The campaign matches ESET's wider finding that Ukraine was targeted significantly more by Russia-aligned groups in Q2-Q3 2026. MDaemon 26.0.4, released 2026-08-25, ships a fixed ClamAV. Detection guidance in the source: hunt the mail server filesystem for unexpected DLLs, watch for outbound C2 connections and Telegram bot API traffic, audit mailboxes for unauthorized access or exfiltration, and restrict the mail server's outbound internet access. The sources list no network IOCs, file hashes or DLL names, and CVSS for the MDaemon abuse is not separately scored. The NVD CVSS v3.1 score of 8.8 and the CNA (ESET) v3.1 score of 8.4 are inherited from the WinRAR/ClamAV CVE entries. Note: GBHackers gives a ClamAV fix date of 2025-07-27, which conflicts with ClamAV 1.5.4 release coverage (2026-08-07); this record uses the latter.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.001 Spearphishing Attachment
- T1203 Exploitation for Client Execution
- T1071.001 Web Protocols
- T1114 Email Collection

## Sources

- [Russian Hackers Exploit MDaemon Mail Server Flaw to Install Backdoors Without User Interaction](https://gbhackers.com/mdaemon-mail-server-flaw/)
- [ESET APT Activity Report Q2 2026 - Q3 2026](https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/)
- [ESET APT Activity Report Q2 2026 - Q3 2026 (PDF)](https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2026-q3-2026.pdf)
- [NVD - CVE-2025-8088](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2025-8088)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [SUSE - CVE-2025-8088 upstream information](https://www.suse.com/security/cve/CVE-2025-8088.html)
- [ClamAV 1.5.4 Open-Source Antivirus Fixes Eight Security Vulnerabilities](https://linuxiac.com/clamav-1-5-4-open-source-antivirus-fixes-eight-security-vulnerabilities/)
- [ClamAV releases (Cisco-Talos/clamav)](https://github.com/Cisco-Talos/clamav/releases)
- [Ubuntu USN-8788-1: ClamAV vulnerabilities](https://ubuntu.com/security/notices/USN-8788-1)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4883