ZimbraMalware
Ransomware [email redacted]From MISP Galaxy
Last reported 2 days ago, by Elastic Security Labs21 reports
ATT&CK techniques
6 of 52 · each with the sentence it comes from- T1505.003Web Shell
“According to Google-owned Mandiant, the attack involved the deployment of a lightweight PHP web shell codenamed SAWFLY for interactive remote access and a tunneling program called BARECLAW to route traffic through the device.”
- T1543.002Systemd Service
“…ra SSH identity, escalated privileges to root using legitimate Zimbra tools, and deployed a secondary persistence mechanism using a systemd service named zimlog.service.”
- T1684Social Engineering
“…arch into calendar-based phishing showed how malicious content can appear inside familiar workflows, while our earlier look at how social engineering is evolving explored the growing use of collaboration tools and other everyday platforms to make attacks feel routine.”
- T1053Scheduled Task/Job
“PersistenceT1053.003 Scheduled Task/Job: CronCrontab ‘* * * * *’ and ‘@reboot’ entries relaunching .kworker_sys.”
- T1055Process Injection
“It identifies memory-backed execution behavior, not the exact syscall or process injection.”
- T1059Command and Scripting Interpreter
“ExecutionT1059.004 Command and Scripting Interpreter: Unix Shellperl to dash or bash; de.sh, agent2.sh, and aliyun_update.tar.gz piped into a shell.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
21 reports · the newest 20, newest first · the exact sentence from each-
How CVE-2026-73570 turns a Zimbra log file into remote code execution“How CVE-2026-73570 turns a Zimbra log file into remote code execution”
-
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More“…CVE-2026-53562, CVE-2026-53563, CVE-2026-53564 (Citrix), CVE-2026-93637, CVE-2026-93635, CVE-2026-73571, CVE-2026-10631, CVE-2026-50055 (Zimbra Collaboration Suite), CVE-2026-0322 (Palo Alto Networks PAN-OS), CVE-2026-76519 (Cisco Secure Email Gateway), CVE-2026-110447 (Collabora…”
-
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)“From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)”
-
The ASOS incident: When attackers use the channels customers trust“Our recent Zimbra research is a good example, because once you can impersonate a sender or edit a calendar from inside the platform, everything the victim checks lives in a system they have no reason to question.”
-
Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe“Zimbra bug exploited in the wild: A threat actor is hacking and stealing email inboxes from Zimbra servers.”
-
Microsoft catches hackers exploiting Zimbra bug before disclosure“Microsoft catches hackers exploiting Zimbra bug before disclosure”
-
Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure“Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure”
-
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets“Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets”
-
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570“… Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path.”
-
Risky Bulletin: Intel ends paid bug bounties“Security updates: AMD, GitLab, MongoDB, Plesk, ServiceNow, Zimbra.”
-
Zimbra security advisory (AV26-964)“Zimbra security advisory (AV26-964)”
-
When Business Email Compromise Starts Rewriting Reality“This dynamic is central to our analysis as we kick off a series around Rapid7's collaborative research with Zimbra; upcoming installments will explore technical details and broader findings based within the Zimbra Collaboration Suite.”
-
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall“Campaign targets Zimbra bug: Hackers are exploiting a recently patched vulnerability in Zimbra Collaboration Suite.”
-
August 2026 CVE Landscape“August reporting showed two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT after compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in failed attempts against Lang…”
-
July 2026 Threat Trend Report on APT Groups“TA458 and Void Blizzard exploited the “Half-click” vulnerability in Zimbra, Outlook Web Access, Roundcube, and SOGo to use ZimReaper and OWAReaper to collect credentials, contacts, and emails, and establish long-term persistence.”
-
Russian-Alligned TA488 Returns With Persistent Outlook Web Access Attack“…ear, began the campaign on July 22, one day before the company's joint advisory with the NSA and partner agencies on the group's earlier Zimbra activity.”
-
Russian Hackers Exploit New ‘Zero-Click’ Attack Against Western Organizations“…ctors working on behalf of Russia have been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025.”
-
June 2026 CVE Landscape“…cting Cisco IOS XE Web UI, CVE-2016-4437 affecting Apache Shiro, CVE-2021-27076 affecting Microsoft SharePoint, CVE-2022-27925 affecting Zimbra, CVE-2023-32315 affecting Openfire, CVE-2023-46747 affecting F5 BIG-IP, and CVE-2024-36401 affecting GeoServer.”
-
APT28: An Evolution of Tradecraft from X-Agent to LLM Malware“The payload family is tracked as SpyPress, with one variant per webmail platform (Roundcube, Horde, MDaemon, Zimbra).”
-
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia“…gain initial access to the victim’s infrastructure, the attackers used a remote code execution (RCE) vulnerability in the email software Zimbra Collaboration (ZCS) 8.8.15 and 9.0, namely CVE-2022-41352 that enables a threat actor to remotely execute arbitrary code.”
Indicators in its reports
named in the reports above- hxxps://aka[.]ms/downloadazcopy-v10-linuxin 2 reports
- wsweb03.blob.core.windows[.]netin 2 reports
Copy these 2 indicators · defanged
Thanks — we review every report.