Visit us at GITEX 2023 to witness the power of Hive Pro TEM Platform: Schedule a Meeting

Old Zimbra vulnerability used to target Ukrainian Government Organizations

Threat Advisories

Old Zimbra vulnerability used to target Ukrainian Government Organizations


For a detailed advisory, download the pdf file here

The Ukrainian Computer Emergency Response Team (CERT-UA) has issued an alert about a campaign targeting Ukrainian government entities that involve an exploit for an XSS vulnerability in Zimbra Collaboration Suite.

The attackers have been sending out phishing emails with the subject “Volodymyr Zelenskyy presented the Golden Star Orders to servicemen of the Armed Forces of Ukraine and members of the families of the fallen Heroes of Ukraine” which contain JavaScript code that evokes the exploitation of the vulnerability (CVE-2018-6882) in Zimbra Collaboration Suite, an email and collaboration platform.

The vulnerability is exploited in attacks to add a forwarding rule for the victim’s emails to a new address under the attacker’s control. This campaign is attributed to UAC-0097, a currently unknown threat actor, with moderate confidence.

The MITRE ATT&CK TTPs used by UAC-0097 are:

TA0001: Initial Access

T1566: Phishing

T1566.001: Phishing: Spearphishing Attachment

TA0002: Execution

T1204: User Execution

T1059: Command and Scripting Interpreter

T1059.007: Command and Scripting Interpreter: JavaScript

Vulnerability Detail


Patch Links


Sign up to receive our Weekly Threat Digest