Cyberattackers Exploit Zimbra Zero-Day Via ICS

An unknown threat actor masquerading as the Libyan Navy’s Office of Protocol targeted the Brazilian military earlier this year using a malicious calendar (ICS) file to deliver an exploit for a then zero-day vulnerability in Zimbra’s Collaboration Suite. The attack leveraged stored cross-site scripting (XSS) to bypass traditional defenses and exfiltrate data, including emails, contacts and shared folders, with stolen information sent to an attacker-controlled server.

StrikeReady Labs detected the campaign after monitoring ICS files larger than 10KB; the malicious ICS was embedded in an email purporting to be from the Libyan Navy, and the exploit centred on CVE-2025-27915, an XSS flaw in multiple versions of Zimbra Classic Web client. Zimbra subsequently released an updated version, 10.1.9, in June containing a fix to strengthen input sanitisation, with customers urged to upgrade immediately.

The analysis notes the operation as a rare example of directly exploiting open-source collaboration tools via email attachments, rather than server compromises or phishing lures, and cites a Russian-linked group tracked as UNC1151 among the most prolific attackers capable of finding zero-days in such tools.