Security researchers at StrikeReady Labs have uncovered a sophisticated cyberespionage campaign that leveraged malicious calendar (ICS) attachments to exploit a previously unknown zero-day vulnerability in Zimbra’s open-source Collaboration Suite.
The Attack
The campaign — disguised as communication from the Libyan Navy’s Office of Protocol — targeted Brazil’s military earlier this year.
The malicious ICS file contained embedded JavaScript exploiting CVE-2025-27915, a stored cross-site scripting (XSS) flaw in Zimbra’s Classic Web Client.
When the victim opened the email, the script executed silently via an ontoggle event in a <details> tag, giving attackers access to the victim’s Zimbra session and data.
What Makes This Unique
This is one of the first documented cases of attackers exploiting Zimbra directly via email attachments, rather than compromising servers or using phishing lures.
StrikeReady highlighted that this method enables adversaries to bypass traditional email defenses, demonstrating that XSS vulnerabilities can be just as dangerous as remote code execution (RCE) in real-world espionage scenarios.
The Multifunction Payload
The malicious script was designed with multiple modules:
- Credential Theft & Monitoring – Captures usernames, passwords, and session tokens, then exfiltrates them immediately.
- Email Exfiltration – Uses Zimbra’s SOAP API to steal messages every four hours.
- Filter Manipulation – Redirects emails to attacker-controlled ProtonMail accounts.
- Authentication Data Theft – Extracts trusted device details and app-specific passwords, helping attackers bypass MFA.
The malware also employed delays and execution limits to reduce detection and logged out inactive users to capture credentials on re-login.
Zimbra’s Response
Zimbra patched the issue in version 10.1.9 (June 2025), improving HTML sanitization and strengthening security controls.
Broader Context
While StrikeReady avoided direct attribution, it noted that few threat actors possess the expertise to discover and exploit zero-days in collaboration software.
Among those, UNC1151 — a Russian-linked espionage group — is one of the most active in this domain.
This incident highlights how email attachments and collaboration tools remain overlooked yet powerful attack vectors.
At Alcaeus Services, we help organizations detect and mitigate such risks through behavioral monitoring, patch management, and zero-day exposure analysis, ensuring that even subtle vulnerabilities like XSS don’t lead to major breaches.
