Operation Email Thief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
Summary: Volexity identified a threat actor it tracks as TEMP_Heretic running spear-phishing campaigns against a customer in December 2021 that exploited a zero-day cross-site scripting vulnerability in the Zimbra email platform, later assigned CVE-2022-24682 and fixed in Zimbra 8.8.15 P30 Update 2. The attacker sent messages from 74 unique outlook.com addresses over two weeks, using a December 14 reconnaissance wave of remote-image emails followed by lure waves on December 16, 23, 24, and 27 that redirected logged-in users to load JavaScript and steal mailbox contents and attachments.
Bottom line: Volexity tested Zimbra 8.8.15 P29 and P30 and found both vulnerable, while roughly 33,000 servers were running Zimbra and the vendor cites 200,000 businesses plus over a thousand government and financial institutions as users - and Volexity assesses the actor is likely Chinese and stole data with no financial value.
Read the original at Volexity Blog ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2022-24682
- Related
- CVE-2022-24682: Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability Known Exploited Vulnerabilities · Feb 25, 2022US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026