Hackers are exploiting a serious flaw in internet-facing Zimbra mail servers with specially crafted emails. The weakness lets an outsider run commands on a vulnerable server without logging in or persuading an employee to open a message.
The activity centers on CVE-2026-73570, a command-injection issue in the server’s SNMP notification feature. It affects installations where the optional zimbra-snmp package is present and SNMP notifications are enabled, turning a routine monitoring path into an entry point.
Microsoft Threat Intelligence identified and tracked the attacks, finding affected organizations across more than one region and industry.
Microsoft said in a report shared with Cyber Security News (CSN) that attackers combined automated payload delivery with hands-on keyboard activity after gaining access.
The impact extends beyond one mailbox. Investigators saw web shells, encrypted reverse connections, stolen authentication material, persistent remote-access tools and attempts to collect mail data, requiring patching and investigation across the organizations investigated by Microsoft.
Hackers Exploit Zimbra Mail Servers
The exploit abuses how Zimbra processes a crafted SMTP request. Shell characters supplied by an attacker can reach SNMP notification handling; when a service-state change triggers monitoring, the swatchdog process includes that input in a snmptrap command and runs it as the zimbra service account.
No password, account, or user interaction is required. That distinction makes exposed servers especially risky, and it reinforces why the earlier Zimbra RCE exploitation report remains relevant to administrators responsible for public mail infrastructure.
Microsoft observed reconnaissance from July 28 through August 7, after version 10.1.20 became available on July 20 but before public disclosure on August 13.
Operators used lightweight HTTP, DNS and ICMP callbacks to confirm they could execute commands and reach a server’s webroot before delivering malware.
Once inside, the attackers changed web-directory permissions, rebuilt compressed payload pieces and wrote JSP web shells to public application folders.
They removed the staged pieces afterward, then copied alternative web shells to other mailbox nodes, a pattern consistent with persistent email server webshells documented in prior incidents.
The intruders downloaded content with common command-line tools, launched background jobs and opened interactive reverse shells. A named pipe connected a local shell to an encrypted OpenSSL session, letting the operator issue commands and receive results.
They then mapped mailbox and mail-transfer nodes, checked Zimbra’s existing SSH identity and used it with rsync to move tools between trusted cluster systems. This extended access beyond the initially compromised server.
Stolen Credentials
The campaign went after service secrets rather than only individual user passwords. Using Zimbra configuration and directory queries, attackers collected credentials for LDAP, MySQL, Postfix and other services, along with pre-authentication keys, token-signing material and two-factor secrets.
Those keys are highly sensitive because they can support access beyond a single mailbox. A Zimbra-specific implant also read the local configuration file, exported database tables and staged certificates, private keys and directory data for transfer, though available evidence did not confirm every attempted transfer succeeded.
On one server, attackers archived mailbox backup data into a local file and tried to send it to cloud storage. Other evidence showed a privilege escalation route that manipulated a writable log location and PAM configuration, ultimately granting the zimbra account passwordless administrative access.
.webp)
Researchers found a disguised system service outside normal Zimbra directories, enabled at boot and given misleading timestamps.
Other payload mechanisms involved scheduled tasks, startup files, SSH keys and local accounts, underscoring why defenders must inspect multiple persistence routes.
Administrators should immediately upgrade to Zimbra 10.1.20 or later. Where that cannot happen at once, remove zimbra-snmp, disable SNMP notifications, and restrict SNMP and SMTP access to trusted hosts.
The SNMP command injection flaw advisory also recommends reviewing monitoring settings and unusual command activity. Teams should treat a reverse-shell alert on an internet-facing mail server as a priority incident.
Inspect every mailbox node for unexpected JSP files, generated servlet artifacts and recent permission changes; rotate Zimbra pre-authentication keys; review system services for suspicious ownership, enablement or timestamp changes; and preserve logs before containment.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| IPv4:Port | 117.107.25[.]243:7071 | Dropper C2 serving de.sh |
| IPv4:Port | 192.255.193[.]111:9004 | Miner C2 serving the build_amd64 cryptominer staged as .kworker_sys |
| Dynamic-DNS domain | transzimbra[.]linkpc[.]net | Dropper C2 serving agent.sh, agent2.sh, and zimdown2 |
| Dynamic-DNS domain | psk1zim[.]abrdns[.]com/agentws | zimclient2 WebSocket and raw TCP command channel |
| Domain | tls[.]psk1zim[.]abrdns[.]com | zimclient2 TLS command channel |
| WebSocket URL | wslogzimbra[.]linkpc[.]net/wsstat | zimdown2 installer status reporting |
| S3-hosted URL | mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws[.]com/pakistan/2026/aliyun_update.tar.gz | Tarball dropper executed on one host and retried elsewhere |
| IPv4:Port | 45.32.30[.]235:8081 | Reverse-shell C2 |
| IPv4:Port | 45.32.30[.]235:8080 | Interactive session and mail-store staging C2 |
| IPv4:Port | 193.42.40[.]135:443 | Organization-wide reverse-shell and reconnaissance C2 |
| IPv4:Port | 3.209.137[.]175:443 | Secondary C2 infrastructure |
| Public GitHub release | github[.]com/ | Repurposed privilege-escalation payload |
| Base contract address | 0x25bdA7Feb3553995AD68a9A8Ed8c731b73a71586 | Command channel for the memory-executed stage |
| SHA-256 | dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a | de.sh |
| SHA-256 | aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d | build_amd64 |
| SHA-256 | 6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244 | agent2.sh |
| SHA-256 | bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf | zimdown2 |
| SHA-256 | b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159 | Zimclient2 |
| SHA-256 | 65A7576C389326B6CDF9C993D0BE6E5D50FED9655D1CDF2A3A50F2C21C8EC435 | Looptik hacktool |
| SHA-256 | 22EF852F6EBC39EE71235B90648B4B200B385C47D25C79545986493F8C70DB69 | Loader staged as systemd-resolved |
| SHA-256 | 518FE65DD349180191D9B258AB24876AAED6613CD657D0B626D1FC24E03A22B6 | Decoded in-memory stage 2 and Base-chain command agent |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
