Russian hackers target Zimbra servers via patched flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about ongoing attacks targeting Zimbra Collaboration email servers. The Russian state-sponsored hacking group known as Laundry Bear, or Void Blizzard, is combining phishing campaigns with the exploitation of a vulnerability that has already been patched by Zimbra. The attacks aim to steal email data from affected organizations.

What happened

CISA’s advisory states that Laundry Bear is actively targeting organizations using Zimbra Collaboration servers. The group is leveraging a known security flaw in the software, which Zimbra addressed in a prior update. However, unpatched servers remain vulnerable to exploitation. The attacks do not rely solely on the vulnerability; phishing emails are also being used to gain initial access to targeted systems. The source did not specify the number of victims or the sectors most affected.

The advisory does not detail the exact timeline of the attacks, but it confirms that the vulnerability in question has been publicly known and patched. Organizations that have not applied the update are at risk of email theft and further compromise.

What we don’t know yet

The advisory does not provide information on the scale of the attacks, such as the number of compromised organizations or the specific data accessed. It also does not clarify whether the phishing component of the attack involves novel techniques or known methods. Additionally, the timing of the initial exploitation remains unclear, as the source does not specify when the attacks began or whether they are ongoing.