Pierluigi Paganini August 18, 2023

A massive social engineering campaign is targeting users of the Zimbra Collaboration email server to steal their login credentials.

ESET researchers uncovered a mass-spreading phishing campaign targeting users of the Zimbra Collaboration email server since April 2023. Zimbra Collaboration is an open-core collaborative software platform.

The campaign is still ongoing and is targeting a wide range of small and medium businesses and governmental entities.

Most of the victims are in Poland, followed by Ecuador and Italy.

The phishing messages include a phishing page in the attached HTML file, they warn the recipient of an email server update, account deactivation, or similar issue. The content of the email is crafted to trick the recipient into opening the attached file. The attackers also spoof the From: field of the email to appear to be an email server administrator.

The HTML file contains a fake Zimbra login page tailored to the victim organization. The page includes a Username field prefilled with the victim’s email address in an attempt to appear as legitimate. Once the recipient has provided the credentials, they are collected from the HTML form and sent via an HTTPS POST request to a server under the control of the attackers.

The POST request destination URLs use the following pattern: https://<SERVER_ADDRESS>/wp-admin/ZimbraNew.php

This campaign stands out because threat actors also relied on compromised accounts of previously targeted companies. This circumstance suggests that the attackers were able to take over administrator accounts associated with those victims and used them to send emails to other potential targets.

“Interestingly, on several occasions we observed subsequent waves of phishing emails sent from Zimbra accounts of previously targeted, legitimate companies, such as donotreply[redacted]@[redacted].com. It is likely that the attackers were able to compromise the victim’s administrator accounts and created new mailboxes that were then used to send phishing emails to other targets.” states the report published by ESET. “One explanation is that the adversary relies on password reuse by the administrator targeted through phishing – i.e., using the same credentials for both email and administration. From available data we are not able to confirm this hypothesis.”

The researchers pointed out that this campaign is still very effective despite it is not sophisticated. Zimbra Collaboration servers are an attractive target for threat actors, the researchers highlighted that this solution is very popular among organizations that are expected to have lower IT budgets.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Zimbra Collaboration)