Zimbra Zero-Day Exploited to Target Brazilian Military via Malicious ICS Files

A security vulnerability in Zimbra Collaboration, tracked as CVE-2025-27915 with a CVSS of 5.4, was exploited as a zero-day earlier this year in attacks against the Brazilian military, via a stored cross-site scripting flaw in the Classic Web Client that targets ICS calendar files. According to a description in the NIST NVD, the flaw arises from insufficient sanitisation of HTML content in ICS calendar entries, allowing arbitrary JavaScript execution when a malicious ICS is viewed.

Zimbra released patches in versions 9.0.0 Patch 44, 10.0.13, and 10.1.5 on 27 January 2025, though the advisory states it has no mention of real-world exploitation.

However, StrikeReady Labs reported on 30 September 2025 that in-the-wild activity involved unknown threat actors spoofing the Libyan Navy’s Office of Protocol to target the Brazilian military with malicious ICS files exploiting the flaw, employing a data-stealing JavaScript payload to exfiltrate credentials, emails, contacts and shared folders to ffrk[.]net.

The ICS file also adds malicious Zimbra email filters to forward messages to a Proton address, and the script is designed to evade detection by hiding UI elements and detonating after more than three days. Found this article interesting? according to ESET, the Russian threat actor known as APT28 has previously exploited XSS vulnerabilities in various webmail solutions, including Zimbra, to obtain unauthorised access.