Hackers exploited Zimbra flaw as zero-day utilizing iCalendar recordsdata

Researchers monitoring for bigger .ICS calendar attachments discovered {that a} flaw in Zimbra Collaboration Suite (ZCS) was utilized in zero-day assaults firstly of the yr.

ICS recordsdata, also called iCalendar recordsdata, are used to retailer calendar and scheduling info (conferences, occasions, and duties) in plain textual content, and to alternate it between numerous calendar purposes.

Risk actors exploited CVE-2025-27915, a cross-site scripting (XSS) vulnerability in ZCS 9.0, 10.0, and 10.1, to ship a JavaScript payload onto goal programs.

The vulnerability stems from inadequate sanitization of HTML content material in ICS recordsdata, which allowed attackers to execute arbitrary JavaScript throughout the sufferer’s session, like setting filters that redirect messages to them.

Zimbra addressed the security concern on January 27 by releasing ZCS 9.0.0 P44, 10.0.13, and 10.1.5, however didn’t point out any lively exploitation exercise.

Nonetheless, researchers at StrikeReady, an organization that develops an AI-driven security operations and risk administration platform, found the assault after conserving a watch out for .ICS recordsdata that had been bigger than 10KB and included JavaScript code.

They decided that the assaults had began firstly of January, earlier than Zimbra launched the patch.

The risk actor spoofed the Libyan Navy’s Workplace of Protocol in an electronic mail that delivered a zero-day exploit that focused a Brazilian army group.

The malicious electronic mail contained a 00KB ICS file with a JavaScript file that was obfuscated utilizing the Base64 encoding scheme.

In accordance with the researchers’ evaluation, the payload is designed to steal knowledge from Zimbra Webmail, like credentials, emails, contacts, and shared folders.

StrikeReady says that the malicious code is carried out to execute in asynchronous mode and into numerous Instantly Invoked Perform Expressions (IIFEs). The researchers discovered that it will probably carry out the next actions:

• Create hidden username/password fields
• Steal credentials from login varieties
• Monitor consumer exercise (mouse and keyboard) and log out inactive customers to set off theft
• Use Zimbra SOAP API to look folders and retrieve emails
• Ship electronic mail content material to attacker (repeats each 4 hours)
• Add a filter named “Correo” to ahead mail to a Proton deal with
• Acquire these authentication/backup artifacts and exfiltrate them
• Exfiltrate contacts, distribution lists, and shared folders
• Add a 60-second delay earlier than execution
• Implement a 3-day execution gate (solely runs once more if ≥3 days since final run)
• Cover consumer interface (UI) components to scale back visible clues

StrikeReady couldn’t attribute this assault with excessive confidence to any recognized risk teams, however famous that there’s a small variety of attackers that may uncover zero-day vulnerabilities in broadly used merchandise, mentioning {that a}”Russian-linked group is very prolific.”

The researchers additionally talked about that comparable ways, methods, and procedures (TTPs) have been noticed in assaults attributed to UNC1151 – a risk group that Mandiant linked to the Belarusian authorities.

StrikeReady’s report shares indicators of compromise and a deobfuscated model of the JavaScript code from the assault leveragin .INC calendar recordsdata.

BleepingComputer has contacted Zimbra with questions on this exercise, and we’ll replace this submit with their assertion as soon as we obtain it.