Mass-spreading marketing campaign focusing on Zimbra customers

December 16, 2023

1

ESET Analysis

ESET researchers have noticed a brand new phishing marketing campaign focusing on customers of the Zimbra Collaboration e mail server.

17 Aug 2023
•
,
5 min. learn

Mass-spreading campaign targeting Zimbra users

ESET researchers have uncovered a mass-spreading phishing marketing campaign, aimed toward amassing Zimbra account customers’ credentials, energetic since at the least April 2023 and nonetheless ongoing. Zimbra Collaboration is an open-core collaborative software program platform, a well-liked various to enterprise e mail options. The marketing campaign is mass-spreading; its targets are a wide range of small and medium companies and governmental entities.

In keeping with ESET telemetry, the best variety of targets are situated in Poland, adopted by Ecuador and Italy. Goal organizations range: adversaries don’t give attention to any particular vertical with the one factor connecting victims being that they’re utilizing Zimbra. To this point, we’ve not attributed this marketing campaign to any recognized menace actors.

Countried hit by the campaign — *Determine 1. International locations hit by the marketing campaign, based on ESET telemetry*

Initially, the goal receives an e mail with a phishing web page within the connected HTML file. As proven in Determine 2, Determine 3 and Determine 4, the e-mail warns the goal about an e mail server replace, account deactivation, or related concern and directs the consumer to click on on the connected file. The adversary additionally spoofs the From: discipline of the e-mail to look like an e mail server administrator.

Zimbra warning — *Determine 2. Lure e mail warning in Polish about deactivation of the goal’s Zimbra account*

Translated lure email — *Determine 3. Machine translation of lure e mail, initially in Polish*

Lure email in italian — *Determine 4. Lure e mail in Italian; which means is identical as in Determine 3*

After opening the attachment, the consumer is offered with a faux Zimbra login web page custom-made based on the focused group, as proven in Determine 5. The HTML file is opened within the sufferer’s browser, which could trick the sufferer into believing they had been directed to the official login web page, although the URL factors to a neighborhood file path. Be aware that the Username discipline is prefilled within the login kind, which makes it seem extra official.

Fake login — *Determine 5. Faux Zimbra login web page*

In Determine 6 we’re offering an instance of official Zimbra webmail login web page for the comparability.

Legitimate login — *Determine 6. Instance of a official Zimbra login web page*

Within the background, the submitted credentials are collected from the HTML kind and despatched by HTTPS POST request to a server managed by the adversary (Determine 7). The POST request vacation spot URLs use the next sample: https://<SERVER_ADDRESS>/wp-admin/ZimbraNew.php

*Determine 7. Code snippet liable for the POST request exfiltrating targets’ credentials*

Curiously, on a number of events we noticed subsequent waves of phishing emails despatched from Zimbra accounts of beforehand focused, official corporations, akin to donotreply[redacted]@[redacted].com. It’s possible that the attackers had been capable of compromise the sufferer’s administrator accounts and created new mailboxes that had been then used to ship phishing emails to different targets. One rationalization is that the adversary depends on password reuse by the administrator focused by means of phishing – i.e., utilizing the identical credentials for each e mail and administration. From accessible knowledge we’re not capable of verify this speculation.

The marketing campaign noticed by ESET depends solely on social engineering and consumer interplay; nevertheless, this may occasionally not all the time be the case. In a earlier marketing campaign described by Proofpoint in March 2023, the APT group Winter Vivern (aka TA473) had been exploiting the CVE-2022-27926 vulnerability, focusing on webmail portals of army, authorities, and diplomatic entities of European nations. In one other instance, reported by Volexity in February 2022, a bunch named TEMP_Heretic exfiltrated emails of European authorities and media organizations by abusing one other vulnerability (CVE-2022-24682) within the Calendar function in Zimbra Collaboration. In the newest point out, EclecticIQ researchers analyzed a marketing campaign just like the one described in our blogpost. The principle distinction is that the HTML hyperlink resulting in the faux Zimbra login web page is situated immediately within the e mail physique.

Conclusion

Regardless of this marketing campaign not being so technically refined, it’s nonetheless capable of unfold and efficiently compromise organizations that use Zimbra Collaboration, which stays a lovely goal for adversaries. Adversaries leverage the truth that HTML attachments include official code, and the one telltale aspect is a hyperlink pointing to the malicious host. This fashion, it’s a lot simpler to avoid reputation-based antispam insurance policies, in comparison with phishing strategies the place a malicious hyperlink is immediately positioned within the e mail physique. The recognition of Zimbra Collaboration amongst organizations anticipated to have decrease IT budgets ensures that it stays a lovely goal for adversaries.

For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com.
ESET Analysis gives personal APT intelligence experiences and knowledge feeds. For any inquiries about this service, go to the ESET Risk Intelligence web page.

IOCs

ESET detection names

HTML/Phishing.Gen

Information

We’re unable to share file IoCs as a result of samples include delicate info.

Community

Hosts used to exfiltrate harvested credentials are hosted on shared servers. Detections primarily based solely on IP addresses might result in false positives.

IP	Area	Internet hosting supplier	First seen	Particulars
145.14.144[.]174	fmaildd.000webhostapp[.]com	Hostinger Worldwide Ltd, NL	2019-12-31	Malicious host used to exfiltrate harvested credentials.
145.14.145[.]248	nmailddt.000webhostapp[.]com	Hostinger Worldwide Ltd, NL	2019-12-31	Malicious host used to exfiltrate harvested credentials.
145.14.145[.]122	tmaxd.000webhostapp[.]com	Hostinger Worldwide Ltd, NL	2019-12-31	Malicious host used to exfiltrate harvested credentials.
145.14.144[.]58	posderd.000webhostapp[.]com	Hostinger Worldwide Ltd, NL	2019-12-31	Malicious host used to exfiltrate harvested credentials.
145.14.145[.]94	ridddtd.000webhostapp[.]com	Hostinger Worldwide Ltd, NL	2019-12-31	Malicious host used to exfiltrate harvested credentials.
145.14.145[.]36	mtatdd.000webhostapp[.]com	Hostinger Worldwide Ltd, NL	2019-12-31	Malicious host used to exfiltrate harvested credentials.
173.44.236[.]125	zimbra.y2kportfolio[.]com	Eonix Company, US	2022-05-27	Malicious host used to exfiltrate harvested credentials.

URLs

https://fmaildd.000webhostapp[.]com/wp-admin/ZimbraNew.php
https://mtatdd.000webhostapp[.]com/wp-admin/ZimbraNew.php
https://nmailddt.000webhostapp[.]com/wp-admin/ZimbraNew.php
https://posderd.000webhostapp[.]com/wp-admin/ZimbraNew.php
https://ridddtd.000webhostapp[.]com/wp-admin/ZimbraNew.php
https://tmaxd.000webhostapp[.]com/wp-admin/ZimbraNew.php
https://zimbra.y2kportfolio[.]com/wp/wp-admin/ZimbraNew.php

MITRE ATT&CK

This desk was constructed utilizing model 13 of the MITRE ATT&CK framework.

Tactic	ID	Identify	Description
Useful resource Growth	T1586.002	Compromise Accounts: E mail Accounts	The adversary used beforehand compromised e mail accounts for marketing campaign spreading.
Useful resource Growth	T1585.002	Set up Accounts: E mail Accounts	The adversary created new e mail accounts to facilitate the marketing campaign.
Preliminary Entry	T1566.001	Phishing: Spearphishing Attachment	The marketing campaign was unfold by malicious HTML recordsdata in e mail attachments.
Execution	T1204.002	Person Execution: Malicious File	A profitable assault depends on the sufferer clicking on a malicious file within the attachment.
Persistence	T1136	Create Account	The adversary created new e mail accounts on compromised Zimbra situations for additional spreading of the phishing marketing campaign.
Assortment	T1056.003	Enter Seize: Internet Portal Seize	The adversary captured credentials inserted to a faux login web page.
Exfiltration	T1048.002	Exfiltration Over Various Protocol: Exfiltration Over Uneven Encrypted Non-C2 Protocol	The adversary exfiltrated passwords by POST requests despatched over the HTTPS protocol.