Stealth Russian Operation Targets MDaemon Email Servers via Critical Zero-Day

A covert cyber-espionage campaign attributed to Russian government-aligned hackers is actively exploiting a severe zero-day vulnerability in the popular MDaemon email platform, compromising enterprise-level webmail infrastructure.

Researchers have named the operation “MailStorm”, uncovering its abuse of a previously unknown buffer overflow flaw (CVE-2025-36721) impacting MDaemon Webmail client versions 23.0.0 through 23.5.2.

The attackers orchestrate a sophisticated, multi-phase intrusion sequence, enabling them to extract confidential data, assume control of administrative privileges, and maintain an entrenched presence within compromised networks.

Anatomy of the Exploit

The vulnerability stems from insecure handling of HTTP POST requests during the email attachment process. Malicious actors craft oversized Content-Type headers to deliberately trigger a stack-based buffer overflow, leading to remote code execution (RCE).

High-Profile Targets Across NATO

Initial intrusions were detected in mid-April 2025, primarily affecting government bodies, financial institutions, and critical infrastructure entities across NATO-aligned countries. Post-exploitation activities include credential harvesting, lateral movement, and deployment of custom tools like KrisProxy, a backdoor with ties to APT28, a well-known Russian threat group.

Deceptive Command Channels and Evasion Techniques

To cloak their operations, the adversaries hijack compromised Microsoft Exchange servers as C2 nodes, disguising malicious communication as OAuth traffic. This approach is further obfuscated by LetsEncrypt-issued TLS certificates, effectively sidestepping traditional detection systems that rely on static indicators.

Vendor Acknowledgement and Emergency Response

MDaemon’s parent company publicly acknowledged the vulnerability in a May 12th bulletin, confirming that an emergency patch is under development. Nevertheless, thousands of webmail servers remain exposed and vulnerable.

Attack Lifecycle: From Discovery to Entrenchment

The threat actors initiate their operation by scanning the internet for MDaemon instances open on ports 3000 (HTTP) and 3001 (HTTPS). Once a suitable target is identified, exploitation begins, laying the groundwork for long-term control and data theft.

MailStorm Attack Lifecycle: From Exploit to Exfiltration

According to WeliveSecurity, the MailStorm campaign initiates once attackers locate an MDaemon Webmail instance vulnerable to the CVE-2025-36721 flaw. They craft a hostile HTTP POST request, manipulating it to overflow a memory buffer and hijack the Structured Exception Handler (SEH)—a tactic that gives them control over the execution flow of the target server.

---

Exploit Breakdown – Conceptual Overview

Python

Example of how the exploit structure operates

import requests

target_url = “https://[VICTIM_IP]:3001/webmail.dll”
headers = {
“Content-Type”: “A” * 4096 + “\x74\x06\x41\x00” # Overwrites SEH with JMP ESP
}
payload = b”\x90″ * 20 + shellcode # NOP sled + attacker’s code
requests.post(target_url, headers=headers, data=payload, verify=False)

This exploit triggers a memory overflow that redirects system control to the attacker’s shellcode.

---

Stage One: Establishing Beachhead

Once access is gained, the malware fetches a PowerShell script from an already-compromised Microsoft Exchange server. This script—msupdate.ps1—executes in the background, disabling AMSI (Antimalware Scan Interface), unpacking a malicious DLL disguised as a routine Windows update, and registering it as a persistent Windows service under the alias: WinSock2Helper.

---

Stage Two: Espionage and Data Manipulation

The DLL leverages API hooking to tap into SMTP flows, enabling real-time interception and alteration of internal communications. What sets MailStorm apart is its use of RFC 5322 header injection, a subtle technique for exfiltrating stolen data by embedding it within email metadata—hidden in plain sight.

Example of Data Leakage:

vbnet

Received: from [Internal_User] by mail.example.com (MDaemon 23.5.2)
with ESMTP; Thu, 15 May 2025 12:34:56 +0530
Comments: X-Exfil: aHR0cHM6Ly9leGFtcGxlL2V4ZmlsCg== # Encoded exfil URL

Stealth and Persistence Tactics

To evade analysis and increase persistence:

• Process hollowing is used to embed the malware into a dormant svchost.exe process.
• Encrypted communication channels are established using an XOR-based key derived from the victim’s machine GUID, ensuring that traffic is both unique and difficult to decode without access to the infected system.

---

Risk Mitigation Guidance

Organizations running MDaemon Webmail should act immediately:

• Block external access to ports 3000 (HTTP) and 3001 (HTTPS)
• Segment networks to contain lateral movement
• Flag anomalous POST requests exceeding 4KB in size
• Review logs for signs of tampering or suspicious scripting activity

---

Red Flags & Threat Indicators (IoCs)

Security teams should remain vigilant for:

• Unexpected Windows services named WinSock2Helper
• DNS lookups to .ru domains, especially those disguised as Azure endpoints
• PowerShell instances originating from webmail.dll
• Outbound emails with base64-encoded strings in the Comments or X-* headers