Old Zimbra vulnerability used to target Ukrainian Government Organizations

For a detailed advisory, download the pdf file here

The Ukrainian Computer Emergency Response Team (CERT-UA) has issued an alert about a campaign targeting Ukrainian government entities that involve an exploit for an XSS vulnerability in Zimbra Collaboration Suite.

The attackers have been sending out phishing emails with the subject “Volodymyr Zelenskyy presented the Golden Star Orders to servicemen of the Armed Forces of Ukraine and members of the families of the fallen Heroes of Ukraine” which contain JavaScript code that evokes the exploitation of the vulnerability (CVE-2018-6882) in Zimbra Collaboration Suite, an email and collaboration platform.

The vulnerability is exploited in attacks to add a forwarding rule for the victim’s emails to a new address under the attacker’s control. This campaign is attributed to UAC-0097, a currently unknown threat actor, with moderate confidence.

The MITRE ATT&CK TTPs used by UAC-0097 are:

TA0001: Initial Access

T1566: Phishing

T1566.001: Phishing: Spearphishing Attachment

TA0002: Execution

T1204: User Execution

T1059: Command and Scripting Interpreter

T1059.007: Command and Scripting Interpreter: JavaScript

Vulnerability Detail

Patch Links