Hackers Exploited 0-Day Vulnerability in Zimbra Email Platform to Spy on Users

A threat actor, likely Chinese in origin, is actively attempting
to exploit a zero-day vulnerability in the Zimbra open-source email
platform as part of spear-phishing campaigns that commenced in
December 2021.

The espionage operation — codenamed “EmailThief^[1]” — was detailed by
cybersecurity company Volexity in a technical report published
Thursday, noting that successful exploitation of the cross-site
scripting (XSS) vulnerability could result in the execution of
arbitrary JavaScript code in the context of the user’s Zimbra
session.

Volexity attributed the intrusions, which started on December
14, 2021, to a previously undocumented hacking group it’s tracking
under the moniker TEMP_HERETIC, with the assaults aimed at European
government and media entities. The zero-day bug impacts the most
recent open-source edition of Zimbra running version 8.8.15^[2].

The attacks are believed to have occurred in two phases; the
first stage aimed at reconnaissance and distributing emails
designed to keep tabs if a target received and opened the messages.
In the subsequent stage, multiple waves of email messages were
broadcasted to trick the recipients into clicking a malicious
link.

“For the attack to be successful, the target would have to visit
the attacker’s link while logged into the Zimbra webmail client
from a web browser,” Steven Adair and Thomas Lancaster noted. “The
link itself, however, could be launched from an application to
include a thick client, such as Thunderbird or Outlook.”

The unpatched flaw, should it be weaponized, could be abused to
exfiltrate cookies to allow persistent access to a mailbox, send
phishing messages from the compromised email account to widen the
infection, and even facilitate the download of additional
malware.

“None of the infrastructure identified^[3] […] exactly matches
infrastructure used by previously classified threat groups,” the
researchers said. “However, based on the targeted organization and
specific individuals of the targeted organization, and given the
stolen data would have no financial value, it is likely the attacks
were undertaken by a Chinese APT actor.”

“Users of Zimbra should consider upgrading to version 9.0.0^[4], as there is currently
no secure version of 8.8.15,” the company added.