A now patched safety vulnerability in Zimbra Collaboration was exploited as a zero-day earlier this 12 months in cyber assaults concentrating on the Brazilian army.
Tracked as CVE-2025-27915 (CVSS rating: 5.4), the vulnerability is a saved cross-site scripting (XSS) vulnerability within the Basic Net Shopper that arises on account of inadequate sanitization of HTML content material in ICS calendar recordsdata, leading to arbitrary code execution.
“When a consumer views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes by way of an ontoggle occasion inside a
“This enables an attacker to run arbitrary JavaScript inside the sufferer’s session, doubtlessly resulting in unauthorized actions resembling setting e-mail filters to redirect messages to an attacker-controlled tackle. Because of this, an attacker can carry out unauthorized actions on the sufferer’s account, together with e-mail redirection and information exfiltration.”
The vulnerability was addressed by Zimbra as a part of variations 9.0.0 Patch 44, 10.0.13, and 10.1.5 launched on January 27, 2025. The advisory, nevertheless, makes no point out of it having been exploited in real-world assaults.
Nevertheless, in line with a report printed by StrikeReady Labs on September 30, 2025, the noticed in-the-wild exercise concerned unknown menace actors spoofing the Libyan Navy’s Workplace of Protocol to focus on the Brazilian army utilizing malicious ICS recordsdata that exploited the flaw.
The ICS file contained a JavaScript code that is designed to behave as a complete information stealer to siphon credentials, emails, contacts, and shared folders to an exterior server (“ffrk[.]web”). It additionally searches for emails in a particular folder, and provides malicious Zimbra electronic mail filter guidelines with the identify “Correo” to ahead the messages to spam_to_junk@proton.me.
As a option to keep away from detection, the script is common such that it hides sure consumer interface components and detonates provided that greater than three days have handed because the final time it was executed.
It is at present not clear who’s behind the assault, however earlier this 12 months, ESET revealed that the Russian menace actor referred to as APT28 had exploited XSS vulnerabilities in numerous webmail options from Roundcube, Horde, MDaemon, and Zimbra to acquire unauthorized entry.
An identical modus operandi has additionally been adopted by different hacking teams like Winter Vivern and UNC1151 (aka Ghostwriter) to facilitate credential theft.
