A now patched security vulnerability in Zimbra Collaboration was exploited as a zero-day earlier this yr in cyber assaults concentrating on the Brazilian army.
Tracked as CVE-2025-27915 (CVSS rating: 5.4), the vulnerability is a saved cross-site scripting (XSS) vulnerability within the Traditional Net Shopper that arises because of inadequate sanitization of HTML content material in ICS calendar information, leading to arbitrary code execution.
“When a person views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes by way of an ontoggle occasion inside a <particulars> tag,” based on an outline of the flaw within the NIST Nationwide Vulnerability Database (NVD).
“This enables an attacker to run arbitrary JavaScript inside the sufferer’s session, probably resulting in unauthorized actions similar to setting e-mail filters to redirect messages to an attacker-controlled tackle. Consequently, an attacker can carry out unauthorized actions on the sufferer’s account, together with e-mail redirection and information exfiltration.”
The vulnerability was addressed by Zimbra as a part of variations 9.0.0 Patch 44, 10.0.13, and 10.1.5 launched on January 27, 2025. The advisory, nonetheless, makes no point out of it having been exploited in real-world assaults.
Nevertheless, based on a report revealed by StrikeReady Labs on September 30, 2025, the noticed in-the-wild exercise concerned unknown risk actors spoofing the Libyan Navy’s Workplace of Protocol to focus on the Brazilian army utilizing malicious ICS information that exploited the flaw.
The ICS file contained a JavaScript code that is designed to behave as a complete information stealer to siphon credentials, emails, contacts, and shared folders to an exterior server (“ffrk[.]web”). It additionally searches for emails in a particular folder, and provides malicious Zimbra e-mail filter guidelines with the title “Correo” to ahead the messages to spam_to_junk@proton.me.
As a option to keep away from detection, the script is original such that it hides sure person interface parts and detonates provided that greater than three days have handed because the final time it was executed.
It is at present not clear who’s behind the assault, however earlier this yr, ESET revealed that the Russian risk actor often known as APT28 had exploited XSS vulnerabilities in varied webmail options from Roundcube, Horde, MDaemon, and Zimbra to acquire unauthorized entry.
An identical modus operandi has additionally been adopted by different hacking teams like Winter Vivern and UNC1151 (aka Ghostwriter) to facilitate credential theft.
