Google: zero-day leak in Zimbra used for hacks at government institutions

Cybercriminals were able to attack several government institutions via a zero-day leak in Zimbra’s software suite, Google says. According to the company, four different groups have abused the vulnerability to, among other things, steal emails.

Google writes that the groups have hacked government agencies in Greece, Pakistan, Moldova, Vietnam and Tunisia. The zero-day vulnerability is designated CVE-2023-37580 and is a cross-site scripting vulnerability. Zimbra had made the update available for the leak on GitHub in early July, but the patch did not become available until later that month. During that period, two of the four groups made their move, Google says.

Another group already knew about the vulnerability before Zimbra posted the update on GitHub. He carried out the first attack aimed at a Greek government institution. This was discovered by Google on June 29 and reported to Zimbra. Although the patch had become available, the latest group still used the vulnerability to attack a government agency in Pakistan. Google found out about that attack on August 25.

Source: Google