Cybercriminals exploited Zero-Day vulnerability in Zimbra platform to spy on users

The Zimbra zero-day vulnerability

The Zimbra open-source email platform has a zero-day vulnerability that has been actively exploited by a threat actor, most likely from China, since December 2021, and is expected to continue to be a target in this year.

Zimbra Zero Day Vulnerability

The espionage operation nicknamed “EmailThief” has been detailed in a technical report provided by cybersecurity company Volexity. A successful exploitation of cross-site scripting (XSS) vulnerabilities could result in the execution of arbitrary JavaScript code in the context of a Zimbra session, according to this research.

Volexity claims that TEMP_HERETIC, an illegal cyber group, is responsible for the invasions, which were spotted on December 14, 2021. The attacks were aimed at European government and media entities. The current open-source edition of Zimbra, running version 8.8.15, is affected by the zero-day vulnerability.

As far as the attacking process is concerned, it is believed that it was divided in at least two steps: reconnaissance and the distribution of emails to monitor if a target had received and opened the messages, and then the actual execution of the attacks themselves. Subsequent rounds of emails in waves were sent to trick recipients into clicking on a malicious link, which was erased after that.

For the attack to be successful, the target would have to access the attacker’s link while logged into the Zimbra webmail client via a web browser. However, the connection itself might be launched from an application such as Thunderbird or Outlook.

If the unpatched vulnerability were weaponized, it could be used to steal cookies from a compromised mailbox, providing persistent access to the mailbox and allowing phishing emails to be sent from the compromised email account.

The researchers are noting that the infrastructure that they found in place shares no similarities with any other infrastructure previously identified and used by known threat groups.

Users of Zimbra are encouraged to upgrade to version 9.0.0 in light of the recent disclosures, as there is no safe version of 8.8.15 available at this time.


About the author

Lidia Howler

Lidia is a web content creator with years of experience in the cyber-security sector. She helps readers with articles on malware removal and online security. Her strive for simplicity and well-researched information provides users with easy-to-follow It-related tips and step-by-step tutorials.

Leave a Comment