New Wave of Attack Campaign Targeting Zimbra Email Users for Credential Theft

A new “mass-spreading” social engineering marketing campaign is focusing on buyers of the Zimbra Collaboration email server with an aim to accumulate their login qualifications for use in follow-on functions.

The action, active due to the fact April 2023 and still ongoing, targets a huge variety of compact and medium companies and governmental entities, most of which are found in Poland, Ecuador, Mexico, Italy, and Russia. It has not been attributed to any known menace actor or group.

“Initially, the focus on gets an email with a phishing web page in the connected HTML file,” ESET researcher Viktor Šperka stated in a report. “The email warns the goal about an email server update, account deactivation, or related issue and directs the consumer to simply click on the connected file.”

The messages also spoof the from handle to surface as if they are coming from a Zimbra administrator in a likely try to convince the recipients into opening the attachment.

The HTML file has a Zimbra login page tailor-made to the targeted business, with the Username subject prefilled with the victim’s email handle to make it feel a lot more authentic. When the qualifications are entered, they are collected from the HTML kind and sent by way of a HTTPS Submit ask for to an actor-managed server.

What makes the attacks stand out is their skill to propagate even further. Subsequent phishing waves have leveraged accounts of previously qualified, authentic organizations, suggesting that the infiltrated administrator accounts associated with those people victims ended up made use of to send out e-mails to other entities of interest.

“A person clarification is that the adversary relies on password reuse by the administrator focused via phishing – i.e., applying the very same credentials for the two email and administration,” Šperka observed.

Although the marketing campaign is not technically refined, it financial institutions on the point that “HTML attachments comprise authentic code, and the only telltale component is a url pointing to the malicious host” that’s embedded in the source code.

“This way, it is considerably less difficult to circumvent track record-dependent anti-spam policies, as opposed to phishing strategies in which a malicious website link is instantly put in the email overall body,” Šperka stated.

Identified this article intriguing? Observe us on Twitter  and LinkedIn to browse much more exclusive written content we put up.

Some parts of this article are sourced from:
thehackernews.com