Attackers Exploit Zimbra Flaw to Deploy Web Shells and Steal Mailbox Data
Summary
Microsoft reports attackers exploited Zimbra CVE-2026-73570 to deploy web shells, move laterally, and collect mailbox and authentication data. Zimbra patched the flaw in version 10.1.20; Microsoft recommends patching and hunting for persistence.
Key points
- CVE-2026-73570 is an unauthenticated command-injection flaw affecting Zimbra when SNMP notifications are enabled and the optional zimbra-snmp package is installed.
- Attackers used crafted SMTP requests to gain access, then deployed JSP web shells, reverse shells, and other persistence mechanisms.
- Post-exploitation activity included privilege escalation, mapping Zimbra deployments, and lateral movement between trusted hosts.
- Threat actors collected mailbox data, authentication secrets, and configuration artifacts, and staged data in archives.
- Microsoft observed an attempted exfiltration using AzCopy and an operator-supplied Azure Blob SAS URL; available evidence does not confirm the transfer succeeded.
- Zimbra patched the flaw in version 10.1.20 in July 2026. CERT Polska and CISA later highlighted exploitation, with CISA adding it to the KEV catalog.
- Organizations are advised to patch, or, if that is not possible, remove zimbra-snmp, disable SNMP notifications, restrict SNMP and SMTP access, rotate authentication secrets, and hunt for web shells.
Article Details
- Attack Vectors
- Unauthenticated command injection through specially crafted SMTP requests against exposed Zimbra servers, when SNMP notifications were enabled and the optional zimbra-snmp package was installed.
- After initial access, attackers ran commands as the zimbra service account, deployed JSP web shells and reverse shells, and downloaded or executed payloads using wget or curl.
- Attackers used Zimbra’s SSH identity and rsync to move web shells and helper scripts between trusted Zimbra hosts.
- A Go-based payload extracted Zimbra service-account credentials and queried MySQL and LDAP to collect mailbox, authentication, and configuration data.
- Attackers staged collected data in archives and attempted exfiltration using AzCopy with an operator-supplied Azure Blob SAS URL; successful transfer was not confirmed.
- Defensive Notes
- Apply the Zimbra fix; the article identifies version 10.1.20, released in July 2026, as the patched version.
- If patching is not possible, uninstall zimbra-snmp, disable SNMP notifications, and restrict SNMP and SMTP access to trusted hosts.
- Rotate Zimbra authentication secrets and investigate for redundant web shell persistence.
- Review /var/log/zimbra.log for suspicious Zimbra service restarts and check temporary and Zimbra webapps directories for unexpected files.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | wsweb03[.]blob[.]core[.]windows[.]net | Azure Blob hostname in the operator-supplied SAS destination used in an attempted exfiltration; transfer completion was not confirmed. |
| URL | hxxps[:]//aka[.]ms/downloadazcopy-v10-linux | URL used by the attacker to download AzCopy during the reported exfiltration attempt. |
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesAttackers used authenticated LDAP queries with recovered credentials to retrieve high-value Zimbra attributes.T1021.004 · SSHAttackers used Zimbra’s SSH identity to move laterally between trusted Zimbra hosts.T1053.003 · CronAttackers used cron to maintain recurring execution.T1059 · Command and Scripting InterpreterAfter exploitation, attackers ran commands as the zimbra service account and used shell-based execution chains.T1087 · Account DiscoveryAttackers used zmprov to map the deployment and identify mailbox and MTA nodes.T1098.004 · SSH Authorized KeysThe payload was reported to use SSH authorized keys for persistence.T1190 · Exploit Public-Facing ApplicationAttackers exploited the unauthenticated Zimbra command-injection flaw on exposed servers.T1505.003 · Web ShellAttackers deployed JSP web shells in Jetty and mailboxd application paths.T1543.002 · Systemd ServiceAttackers created the zimlog.service systemd service for persistence at boot.T1546.004 · Unix Shell Configuration ModificationThe payload was reported to use shell startup files as a persistence mechanism.T1552.001 · Credentials In FilesA payload extracted Zimbra service-account credentials from /opt/zimbra/conf/localconfig.xml.T1560.001 · Archive via UtilityAttackers compressed harvested files into ZIP archives before transfer.T1567.002 · Exfiltration to Cloud StorageAttackers attempted to exfiltrate an archive using AzCopy to an Azure Blob SAS destination; completion was not confirmed.
CVE
Malware
zimclient2The activity also involved lateral movement, credential theft, and attempted exfiltration using tools such as Zimclient2 and AzCopy, prompting urgent patching and hardening guidance.zimdown2In at least one campaign, the attackers have been found to use a lightweight shell downloader for a Zimdown2 Go binary that then acts as an installer for the Zimclient2 remote-access agent.
Vendors
Products
AzCopyThe activity also involved lateral movement, credential theft, and attempted exfiltration using tools such as Zimclient2 and AzCopy, prompting urgent patching and hardening guidance.Zimbra Collaboration SuiteMicrosoft reported that threat actors exploited the patched Zimbra Collaboration Suite flaw CVE-2026-73570 to deploy web shells, gain persistence, and collect mailbox and authentication data across affected
Tools
OpenSSLEmploy an OpenSSL-encrypted reverse shell to attacker-controlled infrastructure to conduct command execution, payload retrieval, and exfiltration of command output.rsyncRsync is used to transfer JSP web shells and other helper scripts between nodes.Zimclient2The activity also involved lateral movement, credential theft, and attempted exfiltration using tools such as Zimclient2 and AzCopy, prompting urgent patching and hardening guidance.Zimdown2In at least one campaign, the attackers have been found to use a lightweight shell downloader for a Zimdown2 Go binary that then acts as an installer for the Zimclient2 remote-access agent.zmlocalconfigTarget Zimbra’s centralized service and authentication secrets by using the “zmlocalconfig -s” command on the server rather than going after individual mailbox passwords.zmprovMap the Zimbra deployment using zmprov to identify mailbox and MTA nodes for environment discovery.