Hackers Exploit Zimbra Zero-Click Flaw to Take Control of Email Servers

Hackers are exploiting a command injection vulnerability (CVE-2026-73570) in the Zimbra Collaboration Suite. This vulnerability allows attackers to compromise internet-facing email servers without any user interaction.

Microsoft Threat Intelligence has observed attackers deploying webshells, escalating privileges, collecting authentication secrets, and staging mailbox data across organizations in various regions and industries.

Zimbra Zero-Click Flaw

The “zero-click” attack relies on the optional zimbra-snmp package being installed and SNMP notifications being enabled. A specially crafted email can trigger command execution as the Zimbra service account, giving attackers an initial foothold without credentials or requiring recipients to open malicious content.

The vulnerability arises when attacker-controlled SMTP input, containing shell metacharacters, enters Zimbra’s SNMP notification processing. During service-state monitoring, the swatchdog utility incorporates malicious input into an snmptrap shell invocation, allowing execution of embedded operating system commands.

Zimbra released a remediation for this issue in version 10.1.20 on July 20, 2026, before public disclosure on August 13. Microsoft observed probing activity against the injection vector between July 28 and August 7, indicating attempts to exploit this vulnerability after the patch was made available but before it was publicly disclosed.

The attackers validated their execution through HTTP, DNS, and ICMP callbacks to interaction services. Some HTTP probes carried the distinctive ZB73570 User-Agent, while randomized callback subdomains helped confirm successful exploitation.

After exploitation, attackers reconstructed encoded payloads and deployed JSP webshells in Jetty and mailboxd directories. They temporarily altered webroot permissions, then restored them to minimize evidence during basic permission checks. Other tactics included downloading scripts, establishing reverse shells, or executing commands using memory.

Microsoft documented instances of privilege escalation involving legitimate Zimbra service helpers, a writable mailbox-manager log directory, and the sudo PAM configuration.

Attackers manipulated file ownership and exploited a pam_exec hook to gain unrestricted passwordless sudo access. They then restored configuration content while maintaining their elevated privileges.

Persistence mechanisms involved the creation of zimlog.service, a disguised systemd unit installed outside the Zimbra application directories.

Attackers modified its timestamps to mimic existing services and enabled execution at boot. They also reused Zimbra’s SSH identity and rsync to distribute tools and webshells across trusted cluster nodes.

A separate payload chain deployed the Go-based zimdown2 installer and the zimclient2 remote-access agent. This agent supported interactive shells, file transfers, SOCKS5 proxying, and various communication methods including WebSocket, TLS, or raw TCP.

The attackers targeted centralized service credentials and LDAP attributes, which included zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret.

A Zimbra-specific Go implant also exported database content and staged certificates, private keys, and configuration files. Stolen token-signing materials could allow account impersonation without needing individual passwords.

On one server, operators archived mailbox backups and used AzCopy to transfer them to an Azure Blob destination. Microsoft confirmed the data collection and an attempted exfiltration, although the transfer was unsuccessful.

Administrators are advised to upgrade to Zimbra version 10.1.20 or later. Where immediate patching is not possible, Microsoft recommends removing the zimbra-snmp package and turning off SNMP notifications.

Defenders should investigate reverse-shell alerts, inspect all mailbox nodes for redundant JSP webshells, review unexpected systemd services and sudo changes, and rotate the Zimbra authentication secrets. Microsoft cautioned that the attack chain includes multiple compromises; individual hosts may not show every documented stage.

Indicators of compromise

Network indicators

Indicator	Type	Role
117.107.25[.]243:7071	IPv4 (C2)	Dropper C2, serving de.sh
192.255.193[.]111:9004	IPv4 (C2)	Miner C2, serving the build_amd64 cryptominer staged as .kworker_sys
transzimbra[.]linkpc[.]net	Dynamic-DNS domain	Dropper C2, serving agent.sh/agent2.sh/zimdown2
psk1zim[.]abrdns[.]com/agentws	Dynamic-DNS domain	zimclient2 WebSocket (port 80, /agentws) and raw TCP (8080) command channel
tls[.]psk1zim[.]abrdns[.]com	Domain (C2)	zimclient2 TLS command channel (port 443)
wslogzimbra[.]linkpc[.]net/wsstat	WebSocket URL	zimdown2 installer status reporting; separate from payload hosting
mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws[.]com/pakistan/2026/aliyun_update.tar.gz	S3-hosted URL	Tarball dropper; confirmed executed on one host, retried elsewhere
45.32.30[.]235:8081	IPv4:port (C2)	Reverse shell; earliest confirmed C2 in this campaign
45.32.30[.]235:8080	IPv4:port (C2)	Same C2 IP, different port; interactive session + mail-store staging
193.42.40[.]135:443	IPv4:port (C2)	Organization-wide reverse-shell/recon wave
3.209.137[.]175:443	IPv4:port (C2)	Secondary C2, rotated-infrastructure event
github[.]com/<redacted>/lpe-toolkit	Public GitHub release	Legitimate public tool repurposed as an attacker privilege-escalation payload
0x25bdA7Feb3553995AD68a9A8Ed8c731b73a71586	Base contract address	Command channel for the memfd-executed stage; block on JSON-RPC bodies rather than the public RPC providers

File hashes (SHA-256)

Indicator	Type	Role
dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a	SHA-256	de.sh
aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d	SHA-256	build_amd64
6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244	SHA-256	agent2.sh
bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf	SHA-256	zimdown2
b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159	SHA-256	Zimclient2
65A7576C389326B6CDF9C993D0BE6E5D50FED9655D1CDF2A3A50F2C21C8EC435	SHA-256	‘Looptik’ hacktool (GitHub-hosted LPE toolkit)
22EF852F6EBC39EE71235B90648B4B200B385C47D25C79545986493F8C70DB69	SHA-256	Loader staged as ‘systemd-resolved’; installs /usr/sbin/_chronyd and decodes the in-memory stage 2
518FE65DD349180191D9B258AB24876AAED6613CD657D0B626D1FC24E03A22B6	SHA-256	Decoded in-memory stage 2; Base-chain command agent

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.