Rossiya bilan bog'liq tahdid aktorlari MDaemon pochta serveri dasturidagi zaiflikdan foydalanib, serverda kodni ishga tushirmoqda. Jabrlanuvchilar hech narsani ochishi yoki bosishi shart emas.
ESETning 2026-yil II–III choraklari bo'yicha APT faoliyati hisobotida Ukrainada faol kampaniya tasvirlangan. ESET uni ma'lum Rossiya bilan bog'liq guruhga bog'lay olmadi.
ESET tomonidan e'lon qilingan texnik tadqiqotga ko'ra, MDaemon kiruvchi elektron pochta ilovalarini tekshirish uchun ClamAVga tayanadi. ClamAVning eski versiyalari CVE-2025-8088 zaifligiga moyil — bu ESET o'tgan yili aniqlagan WinRAR yo'l o'tish (path traversal) zaifligi.
ClamAV zaiflikni 2025-yil 27-iyulda tuzatgan. MDaemon esa eskirgan libclamunrar.dll kutubxonasini jo'natishda davom etgan.
Hujum zanjiri oddiy: hujumchilar CVE-2025-8088 zaifligidan foydalanadigan zararli RAR arxivini tayyorlaydi, arxivni zaif MDaemon serveridagi har qanday manzilga yuboradi, MDaemon ilovani tekshirish uchun ClamAVni chaqiradi va bu ekspluatatsiyani ishga tushiradi, ekspluatatsiya esa zararli DLLni pochta serverining fayl tizimiga yozadi.
Hujum ijro oqimi diagrammasi (Rasm manbasi: eset)
Hujumchilar hech qanday jalb qiluvchi material ishlatmagan, chunki hech kim xabarni ochishi shart emas. Pochta serverining o'z tekshirish jarayoni ekspluatatsiyani ishga tushiradi.
Bu usul kengroq naqshga mos keladi. Rossiyalik guruhlar Ukrainaga qarshi Rossiya bilan bog'liq WinRAR hujumlari orqali xuddi shu xatodan foydalanishda davom etmoqda.
CERT-UA kampaniyada ishlatilgan ikkita zararli dastur oilasini HELLAGE va HELLTAG deb kuzatmoqda.
PrincessSpy mobil yuklab olish sayti (Rasm manbasi: eset)
Pochta serverlari maxfiy aloqalarni saqlaydi. Bu ularni josuslik guruhlari uchun qimmatli nishonga aylantiradi. Rossiyalik aktorlarning avvalgi kampaniyalari vebpochta zaifliklaridan foydalanib, hisob ma'lumotlari va 2FA sirlarini o'g'irlashgan.
MDaemon zaiflikni 2026-yil 25-avgustda 26.0.4 versiyasida tuzatgan. Eski ClamAV kutubxonasini jo'natadigan 26.0.4 dan oldingi versiyalar hali ham ochiq qolmoqda. Tuzatilgan ClamAV qurilmalari 1.4.6 va 1.5.4.
Himoyachilar MDaemonni darhol 26.0.4 yoki undan yuqori versiyaga yangilash va libclamunrar.dll kabi birga keladigan ClamAV kutubxonalari yangilanganini tasdiqlash orqali muhitni himoya qilishlari kerak.
Xavfsizlik jamoalari pochta serveri fayl tizimini odatiy kataloglardan tashqarida tushirilgan kutilmagan DLLlar uchun tekshirishi, noma'lum C&C serverlariga chiquvchi ulanishlar va pochta serveridan Telegram bot API trafigini qidirishi, pochta qutilarini ruxsatsiz kirish yoki ommaviy xabar o'g'irlash uchun tekshirishi, shuningdek pochta serverlaridan tashqi internetga kirishni cheklashi kerak.
Ukraina va butun Yevropadagi tashkilotlar yangilanmagan MDaemon serverlarini potentsial buzilgan deb hisoblashlari lozim.
Russia-aligned threat actors are exploiting a flaw in MDaemon mail server software to run code on the server. Victims don’t have to open or click anything.
ESET’s APT Activity Report for Q2–Q3 2026 describes an active campaign in Ukraine. ESET could not attribute it to a known Russia-aligned group.
According to technical research published by ESET, MDaemon relies on ClamAV to scan incoming email attachments. Old ClamAV versions are vulnerable to CVE-2025-8088, a WinRAR path traversal flaw that ESET uncovered last year.
ClamAV fixed the flaw on July 27, 2025. MDaemon kept shipping an outdated libclamunrar.dll library.
The attack chain is simple: attackers craft a malicious RAR archive that exploits CVE-2025-8088, email the archive to any address on a vulnerable MDaemon server, MDaemon invokes ClamAV to scan the attachment which triggers the exploit, and the exploit writes a malicious DLL to the mail server’s file system.
Attack Execution Flow Diagram (Image Source: eset)
The attackers used no lure because no one needs to open the message. The mail server’s own scanning process runs the exploit.
This tactic fits a wider pattern. Russian groups continue to abuse the same bug through Russia-aligned WinRAR attacks against Ukraine.
CERT-UA tracks the two malware families used in the campaign as HELLAGE and HELLTAG.
PrincessSpy Mobile Download Site (Image Source: eset)
Mail servers hold sensitive communications. That makes them valuable targets for espionage groups. Earlier campaigns by Russian actors used webmail flaws to steal credentials and 2FA secrets.
MDaemon fixed the flaw on August 25, 2026, in version 26.0.4. Releases before 26.0.4 that ship the old ClamAV library remain exposed. Fixed ClamAV builds are 1.4.6 and 1.5.4.
Defenders must protect environments by upgrading MDaemon to version 26.0.4 or later immediately and confirming that the bundled ClamAV libraries, including libclamunrar.dll, are updated.
Security teams should also review the mail server file system for unexpected DLLs dropped outside normal directories, hunt for outbound connections to unknown C&C servers and for Telegram bot API traffic from the mail server, audit mailboxes for unauthorized access or bulk message exfiltration, and restrict outbound internet access from mail servers.
Organizations in Ukraine and across Europe should treat unpatched MDaemon servers as potentially compromised.