Russian Hackers Exploit MDaemon Mail Server Flaw to Install Backdoors Without User Interaction

What happened

Russian Hackers Exploit MDaemon Mail Server Flaw to Install Backdoors Without User Interaction, according to GBHackers. Russia-aligned threat actors (the person or group behind an attack) are exploiting a flaw in MDaemon mail server software to run code on the server. Victims don’t have to open or click anything.

ESET’s APT Activity Report for Q2–Q3 2026 describes an active campaign in Ukraine. ESET could not attribute it to a known Russia-aligned group. ESET is a software company based in Bratislava, and its products and services include antivirus software.

Mdaemon mail server flaw According to technical research published by ESET , MDaemon relies on ClamAV to scan incoming email attachments. Old ClamAV versions are vulnerable to CVE-2025-8088 (the public catalogue number for a specific software flaw), a WinRAR path traversal flaw that ESET uncovered last year.

ClamAV fixed the flaw on July 27, 2025. MDaemon kept shipping an outdated libclamunrar.dll library. The attack chain is simple: attackers craft a malicious RAR archive that exploits CVE-2025-8088, email the archive to any address on a vulnerable MDaemon server, MDaemon invokes ClamAV to scan the attachment which triggers the exploit, and the exploit writes a malicious DLL to the mail server’s file system.