Latest Hacking News
Months after ensuring that the patch actually works, Google has now disclosed more details about active exploitation of a Zimbra zero-day vulnerability. The tech giant explained how the threat actors exploited the Zimbra zero-day in
.webp)
Cyber Security News
Zimbra Collaboration is an open-source solution software suite with an email server and web client for collaboration.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you.
Bleeping Computer
Hackers leveraged a medium-severity security issue now identified as CVE-2023-37580 since June 29, nearly a month before the vendor addressed it in version 8.8.15 Patch 41of the software on July 25.
Security Affairs
Google TAG revealed that threat actors exploited a Zimbra Collaboration Suite zero-day (CVE-2023-37580) to steal emails from governments.
The Hacker News
Zero-day flaw ( CVE-2023-37580) in Zimbra Collaboration email software was exploited by 4 groups, exposing email data and credentials.
SecurityWeek
Google says a Zimbra zero-day from earlier this year, CVE-2023-37580, was exploited in several campaigns to hack government emails.
The Record
The attacks targeting government agencies were carried out by four different groups throughout the summer, Google's Threat Analysis Group found.
The Record
Chairman Mike Turner and colleagues issued the second proposal in as many weeks to rewrite federal surveillance authorities known as Section 702. A deadline to renew those powers is approaching soon.
The Record
Ransomware group AlphV claimed on its leak site that it reported MeridianLink to the Securities and Exchange Commission (SEC) for not informing the regulator of a cyberattack.
The Hacker News
Microsoft has released fixes to address 63 security bugs in its software for the month of November 2023.
Ars Technica
Previously unknown XSS in Roundcube let Winter Vivern steal government emails.
Infosecurity News
ESET Research reported the vulnerability to the Roundcube team on October 12
SecurityWeek
Russian APT Winter Vivern exploits a zero-day in the Roundcube webmail server in attacks targeting European governments.
The Hacker News
Attention to all Roundcube users: Security researchers have discovered malicious activity from Winter Vivern.
Bleeping Computer
The Winter Vivern Russian hacking group has been exploiting a Roundcube Webmail zero-day since at least October 11 to attack European government entities and think tanks.
The Record
Researchers at security firm ESET said they have been tracking a new campaign by Winter Vivern, which typically supports Russia and Belarus.
Infosecurity News
A new Secureworks report finds that 2023 is on course to be the biggest year on record for victim naming on ‘name and shame’ sites
The Hacker News
Earth Lusca, a China-linked group, is using a stealthy Linux backdoor called SprySOCKS to target government entities worldwide.
Trend Micro
While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor's server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we've dubbed SprySOCKS due to its swift behavior and SOCKS implementation.
The Hacker News
September 2023 Patch Tuesday — Microsoft addresses 59 bugs, including actively exploited zero-day flaws
Cyber Security News
Critical flaws, exploits, and recent techniques for attacking have all been highlighted. We also offer the most latest software upgrades to keep your devices safe.
The Hacker News
Lazarus Group, linked to North Korea, exploits Zoho security flaw to spread QuiteRAT trojan.
-1.webp)
Cyber Security News
A group of researchers recently published a significant mass-spreading phishing campaign targets Zimbra account users, shedding light on a campaign.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Over 3,000 Android Malware spotted using unsupported/unknown compression methods to avoid detection WinRAR flaw enables remote […]
Security Affairs
A massive social engineering campaign is targeting users of the Zimbra Collaboration email server to steal their login credentials. ESET researchers uncovered a mass-spreading phishing campaign targeting users of the Zimbra Collaboration email server since April 2023. Zimbra Collaboration is an open-core collaborative software platform. The campaign is still ongoing and is targeting a wide range of […]
SecurityWeek
Weekly cybersecurity news roundup that provides a summary of noteworthy stories that might have slipped under the radar for the week of August 14, 2023.
The Hacker News
Attention businesses! A sneaky campaign is targeting Zimbra email servers for login credentials.
The Record
According to a report from Slovak software company ESET, hackers have been gathering credentials of Zimbra account users since at least April.
Bleeping Computer
An ongoing phishing campaign has been underway since at least April 2023 that attempts to steal credentials for Zimbra Collaboration email servers worldwide.
Infosecurity News
ESET said the campaign mainly targeted SMEs and governmental entities in Poland, Ecuador and Italy
DarkReading
The APT has been rampaging across three continents on behalf of China's Ministry of State Security, and now claims the throne as kings of intelligence gathering and economic espionage.
The Hacker News
Microsoft's Patch Tuesday for August 2023 addresses 74 vulnerabilities in its software, including 6 Critical and 67 Important security flaws.
SecurityWeek
Five Eyes government agencies publish a list of the software vulnerabilities that were most frequently exploited in malicious attacks in 2022.
Latest Hacking News
Zimbra recently addressed a severe zero-day vulnerability found actively exploited in the wild. While the vulnerability previously received a fix, Zimbra re-released the XSS zero-day patch with the latest software version, urging users to update. Active
SecurityWeek
Zimbra has released patches for a cross-site scripting (XSS) vulnerability that has been exploited in malicious attacks.
Security Affairs
Zimbra addressed a zero-day vulnerability exploited in attacks aimed at Zimbra Collaboration Suite (ZCS) email servers. Two weeks ago Zimbra urged customers to manually install updates to fix a zero-day vulnerability, now tracked as CVE-2023-38750, that is actively exploited in attacks against Zimbra Collaboration Suite (ZCS) email servers. Zimbra Collaboration Suite is a comprehensive open-source messaging and […]
Bleeping Computer
Two weeks after the initial disclosure, Zimbra has released security updates that patch a zero-day vulnerability exploited in attacks targeting Zimbra Collaboration Suite (ZCS) email servers.
Cyber Security News
Our weekly vulnerability roundup will provide coverage of newly discovered vulnerabilities, as well as those exploited to compromise organizations.
Naked Security
Latest episode – check it out now!
Cyber Security News
A new spear-phishing campaign that uses exploited Zimbra and Roundcube email servers to target government organizations.
SecurityWeek
UK firm Netcraft raised $100 million in funding and announced the hiring of a new chief executive to pursue global expansion plans.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Russia-linked APT Gamaredon starts stealing data from victims between 30 and 50 minutes after the initial […]
Naked Security
Zimbra didn’t actually say, “Do not delay/Do it today,” but they did say, “We kindly request your cooperation to apply the fix manually.”
DarkReading
A bug in Zimbra email servers is already being exploited in the wild, Google TAG researchers warn.
Cyber Security News
Recent reports indicate that Zimbra Collaboration Suite 8.8.15 had a vulnerability that exists in the mom veto file on the web server .
SecurityWeek
Several instances of the Reddit alternative Lemmy were hacked in recent days by attackers who had exploited a zero-day vulnerability.
SecurityWeek
Google researchers have discovered that a Zimbra zero-day XSS vulnerability has been exploited in the wild
The Hacker News
Zimbra users, be cautious! Zimbra has warned of an actively exploited zero-day vulnerability in its software. Apply the manual fix ASAP to eliminate
Security Affairs
Zimbra has released updates to address a zero-day vulnerability actively exploited in attacks aimed at Zimbra Collaboration Suite (ZCS) email servers. Zimbra urges customers to manually install updates to fix a zero-day vulnerability that is actively exploited in attacks against Zimbra Collaboration Suite (ZCS) email servers. Zimbra Collaboration Suite is a comprehensive open-source messaging and […]
Bleeping Computer
Zimbra urged admins today to manually fix a zero-day vulnerability actively exploited to target and compromise Zimbra Collaboration Suite (ZCS) email servers.
Cyber Security News
A Notorious MalasLocker Ransomware which has been active since March 2023, targets Zimbra servers and demands charity donations instead of Ransom.
Bleeping Computer
In the ever-shifting ransomware landscape, we saw new ransomware gangs emerge, threat actors return from a long absence, operations shifting extortion tactics, and a flurry of attacks on the enterprise.
Bleeping Computer
A new ransomware operation is hacking Zimbra servers to steal emails and encrypt files. However, instead of demanding a ransom payment, the threat actors claim to require a donation to charity to provide an encryptor and prevent data leaking.
DarkReading
ESET has released its APT Activity Report, which summarizes the activities of selected advanced persistent threat (APT) groups that were observed, investigated, and analyzed by ESET researchers from October 2022 until the end of March 2023.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. CISA adds Veritas Backup Exec flaws to its Known Exploited Vulnerabilities catalog Apple addressed two actively exploited zero-day flaws MSI confirms security breach after Money Message ransomware attack […]
Security Affairs
US CISA has added a Zimbra flaw, which was exploited in attacks targeting NATO countries, to its Known Exploited Vulnerabilities catalog U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Zimbra flaw, tracked as CVE-2022-27926, to its Known Exploited Vulnerabilities Catalog. The CVE-2022-27926 flaw affects Zimbra Collaboration version 9.0.0, which is used to host publicly-facing […]
Cyber Security News
While these phishing emails contain hyperlinks to malicious URLs utilized by the threat actors to abuse the known vulnerabilities to execute JavaScript payloads.
Bleeping Computer
The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a Zimbra Collaboration (ZCS) cross-site scripting flaw exploited by Russian hackers to steal emails in attacks targeting NATO countries.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. If you want to also receive for free the newsletter with the international press subscribe here. LockBit leaks data stolen from the South Korean National Tax Service Italy’s Data Protection Authority […]
Cyber Security News
A recently discovered comprehensive toolset dubbed AlienFox toolkit is circulating on Telegram to scan for poorly configured servers.
The Hacker News
Cyber espionage group Winter Vivern targets officials in Europe & US. The threat actor, known as TA473, exploits unpatched Zimbra vulnerabilities in g
Security Affairs
Russian hacking group Winter Vivern has been actively exploiting Zimbra flaws to steal the emails of NATO and diplomats. A Russian hacking group, tracked Winter Vivern (aka TA473), has been actively exploiting vulnerabilities (CVE-2022-27926) in unpatched Zimbra instances to gain access to the emails of NATO officials, governments, military personnel, and diplomats. The CVE-2022-27926 flaw […]
Security Affairs
Russian hacking group Winter Vivern has been actively exploiting Zimbra flaws to steal the emails of NATO and diplomats. A Russian hacking group, tracked Winter Vivern (aka TA473), has been actively exploiting vulnerabilities (CVE-2022-27926) in unpatched Zimbra instances to gain access to the emails of NATO officials, governments, military personnel, and diplomats. The CVE-2022-27926 flaw […]
Bleeping Computer
A Russian hacking group tracked as TA473, aka 'Winter Vivern,' has been actively exploiting vulnerabilities in unpatched Zimbra endpoints since February 2023 to steal the emails of NATO officials, governments, military personnel, and diplomats.
Security Affairs
AlienFox is a novel comprehensive toolset for harvesting credentials for multiple cloud service providers, SentinelLabs reported. AlienFox is a new modular toolkit that allows threat actors to harvest credentials for multiple cloud service providers. AlienFox is available for sale and is primarily distributed on Telegram in the form of source code archives. Some modules are […]
Ars Technica
Group tracked since 2021 exploits unpatched Zimbra servers to hack email accounts.
CSO
Winter Vivern's campaign shows that threat actors can effectively take advantage of medium-severity vulnerabilities.
The Hacker News
AlienFox, a highly modular & constantly evolving toolset distributed on Telegram, enables attackers to harvest API keys & secrets from cloud services.
Bleeping Computer
A new modular toolkit called 'AlienFox' allows threat actors to scan for misconfigured servers to steal authentication secrets and credentials for cloud-based email services.
CSO
Cybercriminals are now exploiting zero-day vulnerabilities for higher profits, which might require a reassessment of your risk.
DarkReading
Lazarus Group used a known Zimbra bug to steal data from medical and energy researchers.
Cyber Security News
The North Korean Lazarus hacking group has been identified as the culprit behind a recent cyber espionage operation known as "No Pineapple!".
The Record
North Korea's Lazarus Group is accused of targeting an Indian medical research company and other businesses in the energy sector.
Bleeping Computer
A new cyber espionage campaign dubbed 'No Pineapple!' has been attributed to the North Korean Lazarus hacking group, allowing the threat actors to stealthily steal 100GB of data from the victim without causing any destruction.
The Hacker News
North Korean Lazarus hacking group exploited unpatched Zimbra devices to invade healthcare research institutions, universities, and technology firms.
DarkReading
An OpSec slip from the North Korean threat group helps researchers attribute what was first suspected as a ransomware attack to nation-state espionage.
DarkReading
Attackers are targeting Zimbra systems in the public and private sectors, looking to exploit multiple vulnerabilities, CISA says.
CyberSecurity Dive
Months after warnings to patch the Zimbra Collaboration Suite, government and private sector organizations are under attack from multiple threat actors.
Security Affairs
Threat actors have compromised hundreds of servers exploiting critical flaw CVE-2022-41352 in Zimbra Collaboration Suite (ZCS). Last week, researchers from Rapid7 warned of the exploitation of unpatched zero-day remote code execution vulnerability, tracked as CVE-2022-41352, in the Zimbra Collaboration Suite. Rapid7 has published technical details, including a proof-of-concept (PoC) code and indicators of compromise (IoCs) regarding […]
Bleeping Computer
Almost 900 servers have been hacked using a critical Zimbra Collaboration Suite (ZCS) vulnerability, which at the time was a zero-day without a patch for nearly 1.5 months.
DarkReading
A flaw in unpatched Zimbra email servers could allow attackers to obtain remote code execution by pushing malicious files past filters.
SecurityWeek
The Zimbra Collaboration Suite is affected by a critical, unpatched remote code execution vulnerability already exploited in attacks.
Latest Hacking News
A severe zero day vulnerability has been discovered in the Zimbra Collaboration Suite (ZCS) that has been under active exploit prior to a patch being released. Zimbra Collaboration Suite Zero-Day Vulnerability Reportedly, an unpatched remote code execution
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs free for you in your email box. If you want to also receive for free the newsletter with the international press subscribe here. BlackByte Ransomware abuses vulnerable driver to bypass security solutions Unpatched remote code execution flaw in Zimbra […]
Security Affairs
Threat actors are exploiting an unpatched severe remote code execution vulnerability in the Zimbra collaboration platform. Researchers from Rapid7 are warning of the exploitation of unpatched zero-day remote code execution vulnerability, tracked as CVE-2022-41352, in the Zimbra Collaboration Suite. Rapid7 has published technical details, including a proof-of-concept (PoC) code and indicators of compromise (IoCs) regarding […]
The Hacker News
Hackers are exploiting a severe UNPATCHED remote code execution vulnerability in Zimbra enterprise collaboration software and email platform.
Ars Technica
The flaw has been under attack since at least early September.
Bleeping Computer
Hackers are actively exploiting an unpatched remote code execution (RCE) vulnerability in Zimbra Collaboration Suite (ZCS), a widely deployed web client and email server.
Security Affairs
A China-linked APT group named RedAlpha is behind a long-running mass credential theft campaign aimed at organizations worldwide. Recorded Future researchers attributed a long-running mass credential theft campaign to a Chinese nation-state actor tracked RedAlpha. The campaign targeted global humanitarian, think tank, and government organizations. Experts believe RedAlpha is a group of contractors conducting cyber-espionage activity on behalf of […]
Infosecurity News
The advisory was compiled by CISA with the Multi-State Information Sharing & Analysis Center
The Hacker News
A Chinese state-sponsored threat group named RedAlpha has been attributed to a multi-year mass credential theft campaign.
Cyber Security News
More than 200,000 businesses are using Zimbra's email and collaboration platform today across 140 countries. Among them, there are more than 1,000 organizations in the financial and government sectors.
The Record
CISA added two vulnerabilities found in products from digital collaboration platform Zimbra after a cybersecurity firm reported mass exploitation of the bugs throughout July and in early August.
SecurityWeek
A new zero-day vulnerability tracked as CVE-2022-37042 has been exploited since at least June to hack over 1,000 Zimbra email servers.
Security Affairs
Threat actors are exploiting an authentication bypass Zimbra flaw, tracked as CVE-2022-27925, to hack Zimbra Collaboration Suite email servers worldwide. An authentication bypass affecting Zimbra Collaboration Suite, tracked as CVE-2022-27925, is actively exploited to hack ZCS email servers worldwide. Zimbra is an email and collaboration platform used by more than 200,000 businesses from over 140 countries. Yesterday, August 11, CISA has […]
The Hacker News
Researchers warn of mass exploitation of the RCE vulnerability in Zimbra (CVE-2022-27925 and CVE-2022-37042).
Bleeping Computer
An authentication bypass Zimbra security vulnerability is being exploited to compromise Zimbra Collaboration Suite (ZCS) email servers worldwide.
Infosecurity News
Over 1,000 ZCS instances around the world were reportedly backdoored and compromised
SecurityWeek
A recently patched UnRAR vulnerability is being exploited in the wild, most likely against Zimbra email servers.
Bleeping Computer
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two more flaws to its catalog of Known Exploited Vulnerabilities, based on evidence of active exploitation.
Cyber Security News
Zimbra CVE-2022-27824 has been added to the CISA's "Known Exploited Vulnerabilities" catalog as a new vulnerability. Hackers are actively exploiting it in attack activities, which indicates it is active in the hacking community.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs free for you in your email box. If you want to also receive for free the newsletter with the international press subscribe here. Greek intelligence service used surveillance malware to spy on a journalist, Reuters reports Slack resets passwords […]
Bleeping Computer
The Cybersecurity and Infrastructure Security Agency (CISA) has added the Zimbra CVE-2022-27824 flaw to its 'Known Exploited Vulnerabilities Catalog,' indicating that it is actively exploited in attacks by hackers.
Security Affairs
US Critical Infrastructure Security Agency (CISA) adds a recently disclosed flaw in the Zimbra email suite to its Known Exploited Vulnerabilities Catalog. The Cybersecurity & Infrastructure Security Agency (CISA) has added a recently disclosed flaw in the Zimbra email suite, tracked as CVE-2022-27924, to its Known Exploited Vulnerabilities Catalog. In middle June, researchers from Sonarsource discovered […]
SecurityWeek
CISA has urged organizations to patch a recent Zimbra credential theft vulnerability after reports of exploitation in the wild.
The Hacker News
CISA has added a high-severity vulnerability in the Zimbra email suite to its Known Exploited Vulnerabilities Catalog.
Infosecurity News
Successful exploitation would give an attacker access to all emails on a compromised server
Security Affairs
Researchers discovered a new flaw in RARlab’s UnRAR utility, tracked CVE-2022-30333, that can allow to remotely hack Zimbra Webmail servers. SonarSource researchers have discovered a new vulnerability in RARlab’s UnRAR utility, tracked as CVE-2022-30333, that can be exploited by remote attackers to execute arbitrary code on a system that relies on the binary, like Zimbra […]
The Hacker News
A new vulnerability has been discovered in RARlab's UnRAR utility that also affects several other applications using it, including Zimbra Mail.
Bleeping Computer
Zimbra and SonarSource proceeded to the coordinated disclosure of a high-severity vulnerability that allows unauthenticated attackers to steal cleartext credentials from Zimbra without any user interaction.
Security Affairs
A high-severity vulnerability in the Zimbra email suite could be exploited by an unauthenticated attacker to steal login credentials of users. Researchers from Sonarsource have discovered a high-severity vulnerability impacting the Zimbra email suite, tracked as CVE-2022-27924 (CVSS score: 7.5), that can be exploited by an unauthenticated attacker to steal login credentials of users without user […]
The Hacker News
A new, high-severity vulnerability has been discovered in the Zimbra email suite that allows unauthenticated attackers to steal plaintext passdwords.
Bleeping Computer
New activity has been observed from Bitter, an APT group focused on cyberespionage, targeting the government of Bangladesh with new malware with remote file execution capabilities.
Security Affairs
Experts disclose an unpatched vulnerability in the RainLoop webmail client, tracked as CVE-2022-29360, that can be exploited to steal users’ emails. RainLoop is an open-source web-based email client used by thousands of organizations, which is affected by a vulnerability, tracked as CVE-2022-29360, that can be exploited to steal users’ emails. The vulnerability is a stored […]
The Hacker News
CISA has issued a new warning that hackers are actively exploiting a recently reported vulnerability in the Windows Print Spooler in the wild.
Bleeping Computer
The Cybersecurity and Infrastructure Security Agency (CISA) has added three new security flaws to its list of actively exploited bugs, including a local privilege escalation bug in the Windows Print Spooler.
Security Affairs
This post provides a timeline of the events related to the Russian invasion of Ukraine from the cyber security perspective. Below is the timeline of the events related to the ongoing invasion that occurred in the previous weeks: April 16 – The unceasing action of Anonymous against Russia This week the Anonymous collective and its […]
The Hacker News
Ukraine government has warned of a new wave of hacking campaigns that spread IcedID malware and exploit Zimbra exploits to steal sensitive information
Security Affairs
A new round of the weekly Security Affairs newsletter arrived! Every week the best security articles from Security Affairs free for you in your email box. If you want to also receive for free the newsletter with the international press subscribe here. U.S. Gov believes North Korea-linked Lazarus APT is behind Ronin Validator cyber heist The […]
The Hacker News
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, including a recently disclosed flaw in Zimbra webmail software
SecurityWeek
The vulnerability was addressed in early February, but exploitation has been ongoing since December 2021.
ZDNet
Log4j also became a top pick for exploitation after the discovery of a critical RCE flaw.
ZDNet
The pay-per-install malware is one of the most popular loaders on the market today.
Cyber Security News
Threat actors are actively exploiting the Zimbra zero-day XSS vulnerability to steal data, the hackers who have exploited the zero-day bug
ZDNet
A zero-day bug in the Zimbra email platform is reportedly under attack.
The Record
A new Chinese cyber-espionage group has been seen abusing a zero-day vulnerability in the Zimbra collaboration suite to gain access to the email inboxes of European governments and media agencies.
Bleeping Computer
A cross-site scripting (XSS) vulnerability in the Zimbra email platform is currently actively exploited in attacks targeting European media and government organizations.
Bleeping Computer
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its list of known exploited vulnerabilities with 15 new security issues that serve as a frequent attack vector against federal enterprises.
ZDNet
Three of the vulnerabilities must be remediated by January 24 for federal civilian agencies.