Hackers are exploiting a serious flaw in internet-facing Zimbra mail servers with specially crafted emails. The weakness lets an outsider run commands on a vulnerable server without logging in or persuading an employee to open a message.

The activity centers on CVE-2026-73570, a command-injection issue in the server’s SNMP notification feature. It affects installations where the optional zimbra-snmp package is present and SNMP notifications are enabled, turning a routine monitoring path into an entry point.

Microsoft Threat Intelligence identified and tracked the attacks, finding affected organizations across more than one region and industry.

Microsoft said in a report shared with Cyber Security News (CSN) that attackers combined automated payload delivery with hands-on keyboard activity after gaining access.

The impact extends beyond one mailbox. Investigators saw web shells, encrypted reverse connections, stolen authentication material, persistent remote-access tools and attempts to collect mail data, requiring patching and investigation across the organizations investigated by Microsoft.

Hackers Exploit Zimbra Mail Servers

The exploit abuses how Zimbra processes a crafted SMTP request. Shell characters supplied by an attacker can reach SNMP notification handling; when a service-state change triggers monitoring, the swatchdog process includes that input in a snmptrap command and runs it as the zimbra service account.

No password, account, or user interaction is required. That distinction makes exposed servers especially risky, and it reinforces why the earlier Zimbra RCE exploitation report remains relevant to administrators responsible for public mail infrastructure.

Microsoft observed reconnaissance from July 28 through August 7, after version 10.1.20 became available on July 20 but before public disclosure on August 13.

Operators used lightweight HTTP, DNS and ICMP callbacks to confirm they could execute commands and reach a server’s webroot before delivering malware.

Attack chain (Source - Microsoft) — Attack chain (Source – Microsoft)

Once inside, the attackers changed web-directory permissions, rebuilt compressed payload pieces and wrote JSP web shells to public application folders.

They removed the staged pieces afterward, then copied alternative web shells to other mailbox nodes, a pattern consistent with persistent email server webshells documented in prior incidents.

The intruders downloaded content with common command-line tools, launched background jobs and opened interactive reverse shells. A named pipe connected a local shell to an encrypted OpenSSL session, letting the operator issue commands and receive results.

They then mapped mailbox and mail-transfer nodes, checked Zimbra’s existing SSH identity and used it with rsync to move tools between trusted cluster systems. This extended access beyond the initially compromised server.

Stolen Credentials

The campaign went after service secrets rather than only individual user passwords. Using Zimbra configuration and directory queries, attackers collected credentials for LDAP, MySQL, Postfix and other services, along with pre-authentication keys, token-signing material and two-factor secrets.

Those keys are highly sensitive because they can support access beyond a single mailbox. A Zimbra-specific implant also read the local configuration file, exported database tables and staged certificates, private keys and directory data for transfer, though available evidence did not confirm every attempted transfer succeeded.

On one server, attackers archived mailbox backup data into a local file and tried to send it to cloud storage. Other evidence showed a privilege escalation route that manipulated a writable log location and PAM configuration, ultimately granting the zimbra account passwordless administrative access.

zimbra-exfil client-dump binary workflow (Source - Microsoft) — zimbra-exfil client-dump binary workflow (Source – Microsoft)

Researchers found a disguised system service outside normal Zimbra directories, enabled at boot and given misleading timestamps.

Other payload mechanisms involved scheduled tasks, startup files, SSH keys and local accounts, underscoring why defenders must inspect multiple persistence routes.

Administrators should immediately upgrade to Zimbra 10.1.20 or later. Where that cannot happen at once, remove zimbra-snmp, disable SNMP notifications, and restrict SNMP and SMTP access to trusted hosts.

The SNMP command injection flaw advisory also recommends reviewing monitoring settings and unusual command activity. Teams should treat a reverse-shell alert on an internet-facing mail server as a priority incident.

Inspect every mailbox node for unexpected JSP files, generated servlet artifacts and recent permission changes; rotate Zimbra pre-authentication keys; review system services for suspicious ownership, enablement or timestamp changes; and preserve logs before containment.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IPv4:Port	117.107.25[.]243:7071	Dropper C2 serving de.sh
IPv4:Port	192.255.193[.]111:9004	Miner C2 serving the build_amd64 cryptominer staged as .kworker_sys
Dynamic-DNS domain	transzimbra[.]linkpc[.]net	Dropper C2 serving agent.sh, agent2.sh, and zimdown2
Dynamic-DNS domain	psk1zim[.]abrdns[.]com/agentws	zimclient2 WebSocket and raw TCP command channel
Domain	tls[.]psk1zim[.]abrdns[.]com	zimclient2 TLS command channel
WebSocket URL	wslogzimbra[.]linkpc[.]net/wsstat	zimdown2 installer status reporting
S3-hosted URL	mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws[.]com/pakistan/2026/aliyun_update.tar.gz	Tarball dropper executed on one host and retried elsewhere
IPv4:Port	45.32.30[.]235:8081	Reverse-shell C2
IPv4:Port	45.32.30[.]235:8080	Interactive session and mail-store staging C2
IPv4:Port	193.42.40[.]135:443	Organization-wide reverse-shell and reconnaissance C2
IPv4:Port	3.209.137[.]175:443	Secondary C2 infrastructure
Public GitHub release	github[.]com/	Repurposed privilege-escalation payload
Base contract address	0x25bdA7Feb3553995AD68a9A8Ed8c731b73a71586	Command channel for the memory-executed stage
SHA-256	dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a	de.sh
SHA-256	aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d	build_amd64
SHA-256	6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244	agent2.sh
SHA-256	bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf	zimdown2
SHA-256	b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159	Zimclient2
SHA-256	65A7576C389326B6CDF9C993D0BE6E5D50FED9655D1CDF2A3A50F2C21C8EC435	Looptik hacktool
SHA-256	22EF852F6EBC39EE71235B90648B4B200B385C47D25C79545986493F8C70DB69	Loader staged as systemd-resolved
SHA-256	518FE65DD349180191D9B258AB24876AAED6613CD657D0B626D1FC24E03A22B6	Decoded in-memory stage 2 and Base-chain command agent

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Hackers Exploit Zimbra Mail Servers With Crafted Emails to Gain Remote Access appeared first on Cyber Security News.