Zimbra users targeted in zero-day exploit using iCalendar attachments

Zimbra users were targeted in a zero-day exploit that weaponised malicious iCalendar (.ICS) attachments to deliver attacks, with StrikeReady researchers identifying the CVE-2025-27915 flaw in Zimbra Collaboration Suite (versions 9.0–10.1) used in these campaigns. The ICS files, used to share calendar data, were designed to execute JavaScript when opened, hijacking sessions, exfiltrating data, and enabling email redirection via a forward rule to a ProtonMail address.

The malicious script targets Zimbra Webmail and exfiltrates credentials, emails, contacts and items from shared folders to the attacker’s server, using evasion techniques such as a 60-second execution delay and a three-day operational window. Researchers noted that the ICS payloads often exceeded 10 KB and that the code runs asynchronously in multiple self-contained blocks, including injection of concealed form fields to capture usernames and passwords.

StrikeReady could not attribute the attack to a specific group, but pointed to TTPs similar to those associated with the Belarusian APT group UNC1151. The article, published on 6 October 2025, also references an earlier 2025 incident where an apparent sender spoofed Libyan Navy infrastructure to deliver a zero-day exploit targeting Brazil’s military. According to StrikeReady.