StrikeReady

Earlier in 2025, an apparent sender from 193.29.58.37 spoofed the Libyan Navy’s Office of Protocol to send a then-zero-day exploit in Zimbra’s Collaboration Suite, CVE-2025-27915, targeting Brazil’s military.

Earlier in 2025, an apparent sender from 193.29.58.37 spoofed the Libyan Navy’s Office of Protocol to send a then-zero-day exploit in Zimbra’s Collaboration Suite, CVE-2025-27915 , targeting Brazil’s military. This leveraged a malicious .ICS file, a popular calendar format .

The exploitation of Zimbra, Roundcube, and similar open-source collaboration tools, directly over email, is rare. Although actors do compromise the servers in broad campaigns, and attackers frequently leverage these tools as lures, actually exploiting a vulnerability in them with an email attachment is a thread worth pulling on. We previously blogged an adjacent, but related attacker, and ESET has authored multiple authoritative blogs on the topic. Proofpoint has reported in depth usages of XSS to steal individuals' mailboxes, and Palo Alto has shown some conceptually similar preview pane vulnerabilities in Outlook. XSS has often been seen as a “lesser” vuln compared to RCE, but these examples should hammer that XSS can be just as effective at accomplishing a goal. There is a very small subset of attackers who are adept at finding these 0days. A Russian-linked group is especially prolific, responsible for the bulk of the above references, although recently UNC1151 also used similar TTPs .

Figure 1: spearphish email

TLDR: we discovered this by watching for ICS files > 10kb that contain javascript. This is a rare enough occurrence that you can put an eyeball on every one.

Figure 2: ICS containing obvious javascript

Carving and decoding this base64 gives familiar looking obfuscation to our blog. Our first step in the analysis process is to try tools such as Obfuscator.io Deobfuscator .

Figure 3: First phase of deobfuscation using deobfuscate.io

Considerable manual analysis (renaming variables, function names, and constants) would be required to fully understand the payload purpose.

However, the payload functionality can also be understood by making an html file which loads the javascript in the script html header

Figure 4: loading the JS via html

One could then debug it by right-clicking and selecting inspect on the webpage using devtools, then going to the sources section where the JS is present. Lastly, set a breakpoint as shown below:

Figure 5: setting a breakpoint

The script is a comprehensive data stealer targeting Zimbra Webmail. It does the following:

Below, we describe a few of the more interesting capabilities in the stealer

Purpose: Only executes if 3+ days have passed since the last execution

Figure 6: function names changed for readability

Figure 7: checking to see if more than 3 days have passed

Purpose: Sends stolen data to the attacker’s server using POST request and mode as “no-cors”

Figure 8: Sending an HTTP POST with the snarfed data

Purpose: Hides UI elements to reduce visibility of the attack

Figure 9: Hiding UI Elements

Purpose: Defines a helper function which sends SOAP requests to Zimbra Server for retrieving information

Figure 10: helper function

1. Function Name: createHiddenFieldsForUsernameAndPasswordCapturing()

Figure 11: Creating Hidden Fields for Credentials Capturing

2. Function Name: stealUsernameAndPasswordFromLoginForm()

Figure 12: Stealing Username and Passwords on login forms

3. Function Name: startActivityMonitoring()

Figure 13: Activity Monitoring

1. Function Name: isMetadataLoaded() & setMetadataLoaded()

Figure 14: Checking Meta data Loading

2. Function Name: searchForEmailsInFolderAndSendToAttackerServer()

Figure 15: Sending Email Content from Folders

3. Function Name: searchEmailsInFolder(folder)

Figure 16: Searching for emails in folders

1. Function Name: addMaliciousFilters()

Figure 17: Adding email filter rules

2. Function Name: addMaliciousEmailFilterRuleAndForwardToProtonMail(isOutgoing)

Figure 18: Forwarding emails to Proton Mail Account

1. Function Name: stealScratchCodeTrustedDevicesGetAppSpecificPasswords()

Figure 19: Stealing Data

1. Function Name: stealContactsAndDistributionLists()

Figure 20: Stealing Data

2. Function Name: stealSharedFolders()

Figure 21: Stealing Data

Figure 22: Indicators mentioned in blog

Our github provides a download of the relevant files mentioned in the blog , including the deobfuscated JS.

Figure 23: Other validated vendor names for this actor

Thanks to K. Shahzad, as well as peer vendors, for their analysis and corrections . Please get in touch at [email protected] if you have corrections, would like us to use your group name, or would like to collaborate on research.