The vulnerability resides in the Zimbra webmail interface, allowing unauthenticated attackers to execute arbitrary commands on the underlying system. While the exact patch version is critical, administrators are strongly advised to verify their current ZCS build against the latest security release. The attackers appear to be targeting exposed instances, with successful exploitation leading to backdoor deployment and data exfiltration.

• Affected software: Zimbra Collaboration Suite (ZCS) versions prior to the latest patched release.
• Attack vector: Unauthenticated remote code execution via a crafted request to the webmail interface.
• Observed impact: Complete server compromise, including mailbox access and credential harvesting.

Indicators of compromise may include unexpected processes running under the zimbra user, modified cron jobs, or outbound network connections to known malicious infrastructure. Organizations running Zimbra should immediately:

• Apply the latest security updates provided by Zimbra.
• Audit server logs for unauthorized access around the time of the patch release.
• Review system accounts and cron entries for persistence mechanisms.
• Rotate credentials for all mail users and service accounts.

The scale of the compromise, with over 270 servers already hit, underscores the importance of urgent patching and monitoring for self-hosted mail environments.

Source: BleepingComputer

Is anyone here running Zimbra on-premises, and what steps are you taking to verify your servers haven't been hit by this campaign?