Malware
ZimReaper
- First Reported
- Jul 15, 2026
- Latest Reported
- Jul 28, 2026
Reported Context (2)
- The malware is an evolution of the ZimReaper payload used in previous campaigns, and shares significant code and behavioral overlaps, including with how the tools gather autofill passwords from the DOM (with the same TA488 Uses Outlook Web Access XSS to Deploy Persistent OWAReaper Implant
- Proofpoint tracks this malware family as ZimReaper. TA488 Used Zimbra XSS Flaw to Steal Emails and Maintain Access
CVE (2)
Malware (1)
People (1)
Threat Actors (3)
MITRE ATT&CK (13)
Vendors (1)
Products (5)
Tools (1)
Industries (10)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.