ESET researchers uncovered a mass-spreading phishing campaign targeting users of Zimbra Collaboration, active since at least April 2023 and continuing. The attackers deploy HTML attachment-based lures with a fake Zimbra login page to harvest credentials and exfiltrate them over HTTPS to attacker-controlled servers. #Zimbra #ZimbraNewPhp #WinterVivern #TA473 #CVE-2022-27926
Keypoints
- The campaign targets a broad set of small to medium businesses and government entities using Zimbra; Poland is the top location, followed by Ecuador and Italy.
- Attackers rely on mass distribution via phishing emails with attached HTML files that display a warning about a server issue or account deactivation.
- Email From fields are spoofed to appear as a Zimbra/enterprise administrator to increase legitimacy.
- After opening the attachment, victims see a fake Zimbra login page with a prefilled Username to appear authentic.
- Credentials are sent via HTTPS POST to attacker-controlled endpoints (ZimbraNew.php on compromised hosts).
- In some waves, attackers reused compromised administrator accounts to send additional phishing emails to other targets.
- The campaign is presented as relatively simple technically, but remains effective due to social engineering and Zimbra’s popularity among budget-conscious organizations.
MITRE Techniques
- [T1586.002] Compromise Accounts: Email Accounts – The adversary used previously compromised email accounts for campaign spreading. Quote: “The adversary used previously compromised email accounts for campaign spreading.”
- [T1585.002] Establish Accounts: Email Accounts – The adversary created new email accounts to facilitate the campaign. Quote: “The adversary created new email accounts to facilitate the campaign.”
- [T1566.001] Phishing: Spearphishing Attachment – The campaign was spread by malicious HTML files in email attachments. Quote: “The campaign was spread by malicious HTML files in email attachments.”
- [T1204.002] User Execution: Malicious File – A successful attack relies on the victim clicking on a malicious file in the attachment. Quote: “A successful attack relies on the victim clicking on a malicious file in the attachment.”
- [T1136] Create Account – The adversary created new email accounts on compromised Zimbra instances for further spreading of the phishing campaign. Quote: “The adversary created new email accounts on compromised Zimbra instances for further spreading of the phishing campaign.”
- [T1056.003] Input Capture: Web Portal Capture – The adversary captured credentials inserted to a fake login page. Quote: “The adversary captured credentials inserted to a fake login page.”
- [T1048.002] Exfiltration: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol – The adversary exfiltrated passwords by POST requests sent over the HTTPS protocol. Quote: “The adversary exfiltrated passwords by POST requests sent over the HTTPS protocol.”
Indicators of Compromise
- [IP] 145.14.144.174, 173.44.236.125 – Malicious hosts used to exfiltrate harvested credentials.
- [Domain] fmaildd.000webhostapp[.]com, nmailddt.000webhostapp[.]com – Malicious hosts used to exfiltrate harvested credentials.
- [Domain] zimbra.y2kportfolio[.]com – Malicious host used to exfiltrate harvested credentials.
- [Hosting provider] Hostinger International Ltd, NL – First seen 2019-12-31; Malicious host used to exfiltrate harvested credentials.
- [Hosting provider] Eonix Corporation, US – First seen 2022-05-27; Malicious host used to exfiltrate harvested credentials.
- [URL] https://fmaildd.000webhostapp[.]com/wp-admin/ZimbraNew.php, https://mtatdd.000webhostapp[.]com/wp-admin/ZimbraNew.php – Endpoints used for credential submission.
- [URL] https://nmailddt.000webhostapp[.]com/wp-admin/ZimbraNew.php, https://ridddtd.000webhostapp[.]com/wp-admin/ZimbraNew.php – Endpoints used for credential submission.
Read more: https://www.welivesecurity.com/en/eset-research/mass-spreading-campaign-targeting-zimbra-users/