Loading story…
A critical security vulnerability in Zimbra Collaboration Suite, tracked as CVE-2025-27915, was exploited as a zero-day in targeted cyberattacks against the Brazilian military. The flaw, a stored cross-site scripting (XSS) vulnerability in the Classic Web Client, resulted from insufficient sanitization of HTML content in ICS (iCalendar) calendar files. Attackers leveraged this vulnerability by sending malicious ICS files embedded with JavaScript code, which executed when a user viewed an email containing the crafted calendar entry. The JavaScript payload enabled arbitrary code execution within the victim's session, allowing attackers to perform unauthorized actions such as setting email filters to redirect messages to attacker-controlled addresses. This facilitated data exfiltration, including the theft of credentials, emails, contacts, and shared folders from compromised Zimbra accounts. The malicious campaign involved threat actors spoofing the Libyan Navy's Office of Protocol to deliver the exploit to Brazilian military targets. The ICS files used in the attack were notably large and contained obfuscated JavaScript, often encoded in Base64 to evade detection. The payload was designed to operate asynchronously and utilized Immediately Invoked Function Expressions (IIFEs) for execution. Researchers at StrikeReady Labs discovered the attack by monitoring for unusually large ICS attachments containing JavaScript. The campaign began at the start of January 2025, prior to Zimbra releasing patches for the vulnerability. Zimbra addressed the issue in versions 9.0.0 Patch 44, 10.0.13, and 10.1.5, released on January 27, 2025, but did not initially disclose that the vulnerability had been exploited in the wild. The attack also included mechanisms to hide certain user interface elements, further reducing the likelihood of detection by end users. The malicious script searched for emails in specific folders and added filter rules named "Correo" to forward messages to a ProtonMail address controlled by the attackers. The exfiltrated data was sent to an external server, ffrk[.]net, under the attackers' control. The exploitation of this vulnerability highlights the risks associated with insufficient input sanitization in webmail platforms and the effectiveness of social engineering tactics, such as spoofing trusted entities. The incident underscores the importance of timely patching and monitoring for anomalous file attachments in email systems. Security researchers recommend organizations using Zimbra Collaboration Suite apply the latest patches and review email filtering rules for signs of compromise. The attack demonstrates the evolving sophistication of threat actors in leveraging zero-day vulnerabilities for targeted espionage campaigns against high-value organizations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CISA added Synacor Zimbra Collaboration Suite flaw CVE-2025-27915 to its Known Exploited Vulnerabilities catalog, formally recognizing active exploitation. The agency required Federal Civilian Executive Branch agencies to remediate the issue by October 28, 2025 under BOD 22-01.
StrikeReady publicly reported that CVE-2025-27915 had been exploited as a zero-day through malicious .ICS calendar files in attacks against Zimbra users. The researchers described the JavaScript payload, exfiltration to attacker infrastructure including ffrk.net, mailbox enumeration via the Zimbra SOAP API, persistence through forwarding rules, and evasion techniques, while stopping short of firm attribution.
Zimbra released a fix for the stored XSS vulnerability CVE-2025-27915 in 2025, after it had already been exploited in the wild. Reports indicate the issue was patched in January 2025, with some coverage specifically citing inclusion in ZCS 10.1.9 released in June 2025.
Earlier in 2025, an unknown threat actor spoofing the Libyan Navy’s Office of Protocol sent weaponized iCalendar (.ICS) emails to target Brazil’s military. Opening the calendar content in Zimbra triggered a then-zero-day stored XSS flaw that enabled theft of credentials, emails, contacts, and other mailbox data, and in some cases creation of malicious mail-forwarding rules.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcethecyberthrone.in
Open sourcesecurityonline.info
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that a cyberespionage campaign tracked as **CL-STA-1114**, overlapping with activity attributed by other vendors to **Void Blizzard** and **LAUNDRY BEAR**, has been exploiting **Zimbra Collaboration Suite** webmail servers at government, defense, transportation, and financial organizations. The activity has affected targets across NATO member states, Ukraine, CIS countries, and Africa, with researchers saying the broader cluster has been active since at least 2024 and Zimbra-focused operations began in July 2025. The attackers used zero-click phishing emails to exploit **`CVE-2025-66376`** in Zimbra webmail, allowing a malicious JavaScript payload to run in victims’ browsers without user interaction. Unit 42 said the malware can steal Zimbra credentials, CSRF tokens, 2FA scratch codes, system details, and up to 90 days of email and search history. Researchers also identified at least nine IP addresses and nine domains tied to command-and-control infrastructure, with servers remaining active for an average of 35.4 days, and warned that unpatched Zimbra instances are being actively targeted.
Jul 23, 2026
More than 10,000 internet-exposed **Zimbra Collaboration Suite** servers remain vulnerable to `CVE-2025-48700`, an actively exploited cross-site scripting flaw that affects ZCS versions `8.8.15`, `9.0`, `10.0`, and `10.1`. The bug lets unauthenticated attackers execute arbitrary JavaScript in a victim’s session and steal sensitive data when a user opens a malicious email in the **Zimbra Classic UI**. Synacor released patches in June 2025, but Shadowserver still reported roughly **10,500** exposed unpatched systems, with the largest concentrations in Asia and Europe. **CISA** has added `CVE-2025-48700` to its **Known Exploited Vulnerabilities** catalog and ordered Federal Civilian Executive Branch agencies to secure affected servers within days because the flaw is being abused in the wild. The warning follows a broader pattern of Zimbra vulnerabilities being used in espionage-focused campaigns, with reporting linking earlier exploitation of similar flaws to Russian-aligned groups including **APT28**, **APT29**, and **Winter Vivern** against Ukrainian entities, NATO-aligned organizations, and other targets.
Jun 29, 2026
Zimbra has urged customers to upgrade to **Zimbra Collaboration 10.1.19** to remediate a critical stored cross-site scripting flaw in the **Classic Web Client**. The vulnerability, which does not yet have a CVE identifier, can be triggered through a specially crafted email and may execute malicious code when a user opens the message in the Classic UI. Successful exploitation could expose **session data, account settings, and mailbox contents**, creating a direct path to account compromise and data theft. The issue was reported by **Google Threat Analysis Group**, and Zimbra said it has **no evidence of active exploitation** so far. The warning has drawn added attention because Zimbra products have been repeatedly targeted in recent years by Russian state-linked groups including **Winter Vivern**, **APT29**, and **APT28**, while other Zimbra flaws have also appeared in **CISA KEV** and been used in campaigns against government, military, and Ukrainian entities.
Jul 23, 2026