Attackers Exploit Zimbra CVE-2026-73570 to Compromise Internet-Facing Mail Servers
Summary
Microsoft details exploitation of unauthenticated command injection in Zimbra’s SNMP notification path, describing web shells, persistence, credential and mailbox collection, and an exfiltration attempt. Zimbra 10.1.20 or later fixes the flaw.
Key points
- CVE-2026-73570 allows unauthenticated command execution through a crafted SMTP request when Zimbra’s optional zimbra-snmp package and SNMP notifications are enabled.
- Zimbra 10.1.20, released July 20, 2026, contains the fix; Microsoft observed probing and exploitation before public disclosure on August 13.
- Attackers deployed JSP web shells, reverse shells, remote-access tooling, and other persistence, and in one observed case escalated privileges to root.
- Operators collected Zimbra service credentials and authentication secrets, moved tools between trusted cluster nodes, and accessed email and mailbox data.
- On one server, attackers staged mailbox backups and invoked AzCopy to transfer data to Azure Blob storage; Microsoft could not confirm the transfer completed.
- Microsoft recommends upgrading to 10.1.20 or later; where patching is delayed, remove zimbra-snmp, disable SNMP notifications, and restrict SNMP and SMTP access.
Article Details
- Attack Vectors
- CVE-2026-73570 allowed unauthenticated OS command injection through Zimbra Collaboration Suite's SNMP notification path when zimbra-snmp was installed and SNMP notifications were enabled.
- Attackers sent crafted SMTP requests that caused attacker-controlled input to reach a shell invocation, enabling command execution as the zimbra service account.
- Observed post-exploitation activity included JSP web-shell deployment, reverse shells, payload downloads, privilege escalation through Zimbra helpers and PAM configuration, and persistence through systemd, cron, and other mechanisms.
- Attackers used Zimbra's SSH identity and rsync to transfer payloads and web shells between trusted cluster nodes.
- Activity included collection of Zimbra service credentials, authentication secrets, and mailbox data. An archive and AzCopy invocation were observed in an exfiltration attempt, but successful transfer was not confirmed.
- Defensive Notes
- Upgrade Zimbra Collaboration Suite to version 10.1.20 or later. If patching is delayed, uninstall zimbra-snmp, disable SNMP notifications, and restrict SNMP and SMTP access to trusted hosts.
- Treat reverse-shell alerts on internet-facing mail servers as priority incidents; scope and contain affected hosts and review credentials.
- Rotate Zimbra authentication secrets, including zimbraPreAuthKey values, and inspect systemd units for unexpected ownership, enablement, or timestamp changes.
- Inspect Zimbra application and servlet-work directories across mailbox nodes for unexpected JSP files, generated servlet artifacts, and recent permission changes.
- Enable Microsoft Defender for Endpoint protections on Linux servers and use endpoint telemetry and behavior-based hunting to investigate exploitation, persistence, and collection activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bypass[.]eu[.]org | Campaign-associated infrastructure used in command-execution validation probes. |
| DOMAIN | tls[.]psk1zim[.]abrdns[.]com | zimclient2 TLS command channel. |
| DOMAIN | transzimbra[.]linkpc[.]net | Dynamic-DNS dropper C2 used to serve agent.sh, agent2.sh, and zimdown2. |
| SHA256 | 22ef852f6ebc39ee71235b90648b4b200b385c47d25c79545986493f8c70db69 | SHA-256 of a loader staged as systemd-resolved that installs /usr/sbin/_chronyd and decodes the in-memory second stage. |
| SHA256 | 518fe65dd349180191d9b258ab24876aaed6613cd657d0b626d1fc24e03a22b6 | SHA-256 of the decoded in-memory second stage, identified as a Base-chain command agent. |
| SHA256 | 65a7576c389326b6cdf9c993d0be6e5d50fed9655d1cdf2a3a50f2c21c8ec435 | SHA-256 of the Looptik hacktool, identified as a GitHub-hosted privilege-escalation toolkit repurposed as a payload. |
| SHA256 | 6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244 | SHA-256 of agent2.sh, identified as a shell downloader. |
| SHA256 | aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d | SHA-256 of build_amd64, identified as a cryptominer. |
| SHA256 | b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159 | SHA-256 of the zimclient2 remote-access agent. |
| SHA256 | bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf | SHA-256 of zimdown2, identified as the installer for the zimclient2 remote-access agent. |
| SHA256 | dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a | SHA-256 of de.sh, identified as a dropper. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationPayloads used names resembling legitimate components, including systemd-resolved, _chronyd, and .kworker_sys.T1053.003 · CronCron entries, including recurring and @reboot entries, were used to relaunch .kworker_sys.T1059.004 · Unix ShellThe injection and subsequent payload chains executed commands through Unix shells, including Perl-to-dash or bash execution and scripts piped to a shell.T1068 · Exploitation for Privilege EscalationThe article reports a GitHub-hosted LPE toolkit staged as .lpe_core and quarantined as Looptik.T1071.001 · Web ProtocolsThe zimclient2 agent used WebSocket tasking, with TLS and raw TCP as additional transports.T1074.001 · Local Data StagingAn archive was staged locally as five.ico in a public Zimbra web directory.T1083 · File and Directory DiscoveryOperators listed directories and probed for writable, executable staging paths.T1102.001 · Dead Drop ResolverEncrypted commands were polled from a Base mainnet contract over public JSON-RPC.T1105 · Ingress Tool TransferAttackers used curl, wget, and other download fallbacks to retrieve payloads onto compromised Zimbra servers.T1190 · Exploit Public-Facing ApplicationA crafted SMTP request reached Zimbra SNMP notification processing and exploited CVE-2026-73570 for remote command execution.T1496 · Resource HijackingA miner was staged as .kworker_sys; the activity also included killing competing miners and sinkholing pools via /etc/hosts.T1505.003 · Web ShellMultiple JSP web shells were deployed in Zimbra application paths and propagated to peer mailbox nodes.T1543.002 · Systemd ServiceAttackers installed and enabled zimlog.service for persistence; a separate payload installed chronyd-helper.service.T1560.001 · Archive via UtilityAttackers used tar to archive Zimbra mail-store data.T1595.002 · Vulnerability ScanningPre-disclosure vulnerability scanning probed the Zimbra injection point using callback subdomains and commands such as ping and nslookup.T1620 · Reflective Code LoadingAn XOR-decoded ELF was executed from memory through memfd_create and /proc/self/fd.
CVE
Malware
agent2.shIn one campaign, the attackers used a multi-stage payload chain beginning with agent2.sh, a lightweight shell downloader that retrieved Stage 1 malware from a dynamic DNS domain and staged it within Zimbra’sBackdoor:Java/ConfigCredDumper.ABackdoor:Java/ConfigCredDumper.ABackdoor:Linux/FakeZimClient.ABackdoor:Linux/FakeZimClient.ABackdoor:Linux/FakeZimDownloader.ABackdoor:Linux/FakeZimDownloader.Abuild_amd64192.255.193[.]111:9004 IPv4 (C2) Miner C2, serving the build_amd64 cryptominer staged as .kworker_sysChopperIndependently of that detector, Microsoft Defender Antivirus detected and quarantined Chopper, GodzillaWebShell, CoinMiner, Looptik, SuspGoLang, and Dirtelti payloads, and behavioral protection alerted on suspiciousDirteltiAntivirus detected and quarantined Chopper, GodzillaWebShell, CoinMiner, Looptik, SuspGoLang, and Dirtelti payloads, and behavioral protection alerted on suspicious permission changes, background execution,FakeZimClient.ABackdoor:Linux/FakeZimClient.AFakeZimDownloader.ABackdoor:Linux/FakeZimDownloader.AGodzillaWebShellIndependently of that detector, Microsoft Defender Antivirus detected and quarantined Chopper, GodzillaWebShell, CoinMiner, Looptik, SuspGoLang, and Dirtelti payloads, and behavioral protection alerted on suspiciousLooptikdetector, Microsoft Defender Antivirus detected and quarantined Chopper, GodzillaWebShell, CoinMiner, Looptik, SuspGoLang, and Dirtelti payloads, and behavioral protection alerted on suspicious permission changes,SuspGoLangMicrosoft Defender Antivirus detected and quarantined Chopper, GodzillaWebShell, CoinMiner, Looptik, SuspGoLang, and Dirtelti payloads, and behavioral protection alerted on suspicious permission changes, backgroundTrojan:Linux/FakeChronydMiner.ATrojan:Linux/SuspKworkerImplant.B Trojan:Linux/FakeChronydMiner.ATrojan:Linux/FakeSysResolved.AATrojan:Linux/FakeSysResolved.AATrojan:Linux/ShellDropper.AATrojan:Linux/ShellDropper.AATrojan:Linux/SuspKworkerImplant.BTrojan:Linux/SuspKworkerImplant.B Trojan:Linux/FakeChronydMiner.Azimbra-exfil/client-dumpIn one case, a Go executable contained the embedded module path zimbra-exfil/client-dump, indicating that it was specifically designed to operate against Zimbra Collaboration Suite installations.zimclient2The downloaded zimdown2 Go binary acted as an installer for the final zimclient2 remote-access agent.zimdown2The downloaded zimdown2 Go binary acted as an installer for the final zimclient2 remote-access agent.
Vendors
MicrosoftMicrosoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path.ZimbraMicrosoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path.
Products
AzureThe actor then downloaded AzCopy from hxxps://aka[.]ms/downloadazcopy-v10-linux and invoked it with an operator-supplied Azure Blob SAS URL targeting wsweb03[.]blob[.]core[.]windows[.]net/log/windows.log.Microsoft DefenderMicrosoft Defender surfaced malicious activity across every observed attack path.Microsoft Defender for EndpointEnable Microsoft Defender for Endpoint protections on Linux servers.Microsoft Defender XDRMicrosoft Defender XDR advanced hunting retains 30 days of raw event data, which no longer covers the pre-disclosure reconnaissance and early exploitation described here.Microsoft Security CopilotMicrosoft Security CopilotMicrosoft Sentinelactivity older than that window, search the second-stage infrastructure listed in the appendix in Microsoft Sentinel or archived logs, and pivot every recovered indicator across the entire device fleet rather thanZimbra Collaboration SuiteMicrosoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path.