Hackers Exploit Zimbra Vulnerability as 0-Day with Weaponized iCalendar Files
A zero-day vulnerability in the Zimbra Collaboration Suite (ZCS) has been actively exploited in targeted attacks in 2025.
A zero-day vulnerability in the Zimbra Collaboration Suite (ZCS) has been actively exploited in targeted attacks in 2025.
The vulnerability, identified as CVE-2025-27915 , is a stored cross-site scripting (XSS) flaw. Attackers exploited this by sending malicious iCalendar (.ICS) files to extract sensitive data from victims' email accounts.
The initial identification of these attacks was conducted by StrikeReady, which observed unusually large iCalendar files containing JavaScript.
A significant incident involved an attack on Brazil's military, where an IP address of 193.29.58.37 was used to impersonate the Libyan Navy's Office of Protocol to deliver the exploit.
The root cause is attributed to Zimbra's Classic Web Client, which did not adequately sanitize HTML content in iCalendar files, allowing threat actors to embed harmful JavaScript in a .ICS attachment.
A zero-day vulnerability in the Zimbra Collaboration Suite (ZCS) has been actively exploited in targeted attacks in 2025.
When users opened an email with the malicious calendar entry, the script executed within their active session.
This XSS vulnerability, although generally considered less severe than remote code execution (RCE) vulnerabilities, was highly effective. It allowed attackers to execute arbitrary code for unauthorized actions, such as data exfiltration and session hijacking, without user awareness.
Zimbra responded to the vulnerability on January 27, 2025, by issuing patches (versions 9.0.0 P44, 10.0.13, and 10.1.5), although the exploit had been used prior to the availability of the fix.
The JavaScript payload delivered via the exploit is a sophisticated data stealer specifically targeting Zimbra webmail. Its features include:
Credential Theft : It creates concealed form fields to capture usernames and passwords from login pages. Data Exfiltration : The script is configured to steal a range of information, including emails, contacts, distribution lists, shared folders, scratch codes, and trusted device information. The data is sent to a server controlled by the attacker at https://ffrk.net/apache2_config_default_51_2_1 . Activity Monitoring : It observes user activity and triggers data theft if a user becomes inactive before logging them out. Email Forwarding : The malware adds a malicious email filter rule named "Correo" to automatically forward the victim's emails to an external address, [email protected] . Evasion Techniques : To evade detection, the script implements a 60-second delay before execution, limits execution to once every three days, and hides user interface elements to obscure its activity.
While direct attribution is unconfirmed, researchers observe that the tactics are akin to those used by a known Russian-linked threat actor and the group UNC1151, associated with the Belarusian government.
This incident highlights the significant risk posed by XSS vulnerabilities in enterprise settings and the necessity for timely application of security patches.
Based on reporting by Cyber Security News.
