InfoSecBulletin Cybersecurity for mankind
Researchers monitoring for larger .ICS calendar attachments found that a flaw in Zimbra Collaboration Suite (ZCS) was used in zero-day attacks at the beginning of the year. ICS files, or iCalendar files, store plain text calendar information, like meetings and events, and allow exchange between different calendar apps.
Threat actors exploited CVE-2025-27915, a cross-site scripting (XSS) vulnerability in ZCS 9.0, 10.0, and 10.1, to deliver a JavaScript payload onto target systems. The vulnerability exists due to inadequate sanitization of HTML content in ICS files, enabling attackers to run harmful JavaScript in the victim’s session and redirect messages.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Zimbra addressed the security issue on January 27 by releasing ZCS 9.0.0 P44, 10.0.13, and 10.1.5, but did not mention any active exploitation activity. Researchers at StrikeReady, a company specializing in AI-driven security and threat management, identified the attack by monitoring .ICS files over 10KB that contained JavaScript code.
They determined that the attacks had started at the beginning of January, before Zimbra released the patch. A hacker pretended to be the Libyan Navy’s Office of Protocol in an email that contained a zero-day exploit aimed at a Brazilian military organization.
Source: StrikeReady
The malicious email included a small ICS file with a hidden JavaScript file.
Source: StrikeReady
The analysis shows that the payload is meant to steal data from Zimbra Webmail, such as login details, emails, contacts, and shared folders.
StrikeReady reports that the malicious code runs asynchronously and uses Immediately Invoked Function Expressions (IIFEs). Researchers identified its capabilities, including:
Create hidden username/password fields
Steal credentials from login forms
Monitor user activity (mouse and keyboard) and log out inactive users to trigger theft
Use Zimbra SOAP API to search folders and retrieve emails
Send email content to attacker (repeats every 4 hours)
Add a filter named “Correo” to forward mail to a Proton address
Collect these authentication/backup artifacts and exfiltrate them
Exfiltrate contacts, distribution lists, and shared folders
Add a 60-second delay before execution
Enforce a 3-day execution gate (only runs again if ≥3 days since last run)
Hide user interface (UI) elements to reduce visual clues
StrikeReady could not attribute this attack with high confidence to any known threat groups but noted that there is a small number of attackers that can discover zero-day vulnerabilities in widely used products, mentioning that a”Russian-linked group is especially prolific.”
Researchers noted that similar tactics, techniques, and procedures (TTPs) are seen in attacks linked to UNC1151, a threat group associated with the Belarusian government by Mandiant.
StrikeReady’s report shares indicators of compromise and a deobfuscated version of the JavaScript code from the attack leveragin .INC calendar files. BleepingComputer reported that they were not received any response while publishing the report from Zimbra.
