Russia-aligned hackers exploit MDaemon mail server flaw to install backdoors
VULNERABILITYESETredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Russia-aligned threat actors are exploiting a flaw in MDaemon mail server software to achieve remote code execution and deploy backdoors without user interaction. ESET's APT Activity Report for Q2 to Q3 2026 describes the activity as an active campaign targeting Ukraine. ESET could not attribute it to a known group. The source does not give a CVE identifier, affected versions or a patch. Defenders running MDaemon should identify exposed instances, check for signs of compromise and apply vendor fixes as they become available.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether your organisation runs MDaemon mail server software.
- Look for signs of compromise on any MDaemon servers, given the active backdoor campaign.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Companies