Old Zimbra vulnerability used to target Ukrainian Government Organizations

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here The Ukrainian Computer Emergency Response Team (CERT-UA) has issued an alert about a campaign targeting Ukrainian government entities that involve an exploit for an XSS vulnerability in Zimbra Collaboration Suite. The attackers have been sending out phishing emails with the subject “Volodymyr Zelenskyy presented the Golden Star Orders to servicemen of the Armed Forces of Ukraine and members of the families of the fallen Heroes of Ukraine” which contain JavaScript code that evokes the exploitation of the vulnerability (CVE-2018-6882) in Zimbra Collaboration Suite, an email and collaboration platform. The vulnerability is exploited in attacks to add a forwarding rule for the victim's emails to a new address under the attacker’s control. This campaign is attributed to UAC-0097, a currently unknown threat actor, with moderate confidence. The MITRE ATT&CK TTPs used by UAC-0097 are: TA0001: Initial Access T1566: Phishing T1566.001: Phishing: Spearphishing Attachment TA0002: Execution T1204: User Execution T1059: Command and Scripting Interpreter T1059.007: Command and Scripting Interpreter: JavaScript Vulnerability Detail Patch Links https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7 References https://cert-gov-ua.translate.goog/article/39606?_x_tr_sl=uk&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp