Threat Summary
Microsoft Threat Intelligence reporting, distributed via AlienVault OTX (TLP:WHITE), tracks active exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite's SNMP notification path. Exploitation occurred in the window between patch availability (July 20, 2026) and public disclosure (August 13, 2026) — a classic patch-gap exploitation pattern indicating the adversary reverse-engineered the fix or obtained pre-disclosure details.
The attack chain is direct and high-impact: an unauthenticated remote attacker injects OS commands through Zimbra's SNMP notification handling, achieving code execution as the zimbra service user, then writes JSP webshells into the web root for persistent, authenticated-equivalent access. Post-exploitation tooling includes China Chopper (S0020) and Godzilla WebShell, alongside tooling associated with the Looptik and NeedyMantis intrusion sets. Mail servers are crown-jewel targets: compromise yields mailbox content, address books, stored credentials, and a trusted relay for internal phishing. Operators have also been observed dropping reverse shells and pursuing privilege escalation from the service account toward root, positioning for credential harvesting from zimbra local config (LDAP bind credentials, MySQL credentials) and ultimately lateral movement into identity infrastructure.
While the pulse carries no sector or geographic targeting metadata, the tradecraft — China Chopper/Godzilla JSP webshells against internet-facing collaboration infrastructure — is consistent with established espionage tradecraft historically used against government, legal, and technology sector mail systems.
Threat Actor / Malware Profile
Initial Access — CVE-2026-73570 (SNMP path command injection)
- Distribution: Direct exploitation of internet-facing Zimbra Collaboration Suite via the SNMP notification handler; no authentication, no user interaction required.
- Behavior: Injected commands execute under the Zimbra service account; operators typically test with outbound callbacks (curl/wget) before writing payloads to disk.
China Chopper (MITRE S0020)
- Payload behavior: Compact one-line JSP webshell accepting tasking via HTTP POST parameters; provides file management, command execution, and database access through a small, easily obfuscated stub.
- C2 communication: HTTP/HTTPS POST to the webshell URI; command content often base64-encoded within request bodies. Long-lived, low-and-slow beaconing is typical.
- Persistence: The JSP file itself, dropped into Zimbra's web root (commonly under
/opt/zimbra/jetty_base/webapps/zimbra/or the publiczimbraPubliccontext). Survives service restarts; does not survive clean rebuilds.
Godzilla WebShell
- Payload behavior: Full-featured encrypted webshell framework (Java/JSP variant here) with plugin modules for command execution, file operations, screenshoting, and database management.
- C2 communication: AES-encrypted payloads inside HTTP requests/responses with cookie-based session keying; traffic blends with normal web sessions.
- Anti-analysis: Payload encryption, in-memory class loading, and traffic patterns designed to evade static signatures and basic network inspection.
Escalation & Expansion
- Reverse shells (bash/perl/python one-liners) launched from the webshell for interactive access.
- Privilege escalation from
zimbrato root via local misconfig or kernel/sudo flaws. - Credential theft from Zimbra configuration (
/opt/zimbra/conf/localconfig.xmlcontains LDAP and MySQL credentials in obfuscated form), mailbox export, and address book harvesting for follow-on phishing.
IOC Analysis
The pulse contains 16 indicators across three types, and SOC teams should operationalize each differently:
- CVE (CVE-2026-73570): Not an IOC in the traditional sense — this is your asset-inventory pivot. Cross-reference against CMDB/vulnerability scanners (Tenable, Qualys, Rapid7) for any Zimbra Collaboration Suite build predating the July 20, 2026 patch. Treat unpatched internet-facing instances as presumptively compromised.
- Hostnames (
psk1zim.abrdns.com,tls.psk1zim.abrdns.com): Likely callback/exfil infrastructure. Thezimsubstring suggests targeted, campaign-specific staging. Operationalize via DNS sinkhole/block at the resolver, TLS SNI inspection, and retro-hunt in DNS/proxy logs for the past 90+ days — the exploitation window dates to July. - FileHash-SHA256 (5 values): Webshell and reverse-shell payload hashes. Push to EDR blocklists, but recognize hashes are brittle — JSP webshells are trivially re-rolled. Use them primarily for retro-hunting file creation events on mail servers and for validating remediation completeness.
Recommended tooling: EDR hash search (CrowdStrike, Defender, SentinelOne) for the SHA256 set; SIEM retro-hunt on DNS and proxy telemetry for the hostnames; and a file-integrity sweep of Zimbra webapp directories for any JSP modified or created since July 2026 regardless of hash match.
Detection Engineering
YAML
---
title: Zimbra SNMP Path Command Injection - Suspicious Process Spawn
description: Detects Zimbra Java/service processes spawning shell or command interpreters, consistent with CVE-2026-73570 SNMP notification path command injection.
status: experimental
logsource:
category: process_creation
product: windows
author: Security Arsenal
references:
- https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/
falsepositives:
- Legitimate Zimbra administrative scripts
- Backup and monitoring agents running as zimbra
level: high
tags:
- attack.initial_access
- attack.t1190
date: 2026/11/01
detection:
selection_parent:
ParentImage|contains:
- 'java'
- 'zimbra'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\bash.exe'
- '\sh.exe'
condition: selection_parent and selection_child
---
title: JSP WebShell Written to Zimbra Web Root
description: Detects creation or modification of JSP files under Zimbra Jetty webapp directories by non-standard processes, consistent with China Chopper / Godzilla webshell deployment.
status: experimental
logsource:
product: linux
service: auditd
author: Security Arsenal
references:
- https://otx.alienvault.com/
falsepositives:
- Legitimate Zimbra upgrades or customizations by administrators
level: critical
tags:
- attack.persistence
- attack.t1505.003
date: 2026/11/01
detection:
selection_path:
name|contains:
- '/opt/zimbra/jetty_base/webapps/'
- '/opt/zimbra/jetty/webapps/'
selection_ext:
name|endswith: '.jsp'
condition: selection_path and selection_ext
---
title: Outbound Connection to CVE-2026-73570 Callback Infrastructure
description: Detects DNS resolution or TLS connections to known callback hostnames associated with the Zimbra CVE-2026-73570 exploitation campaign.
status: experimental
logsource:
category: dns
author: Security Arsenal
falsepositives:
- None expected
level: critical
tags:
- attack.command_and_control
- attack.t1071.001
date: 2026/11/01
detection:
selection:
query|contains:
- 'psk1zim.abrdns.com'
- 'abrdns.com'
condition: selection
KQL — Microsoft Sentinel / Defender
// Hunt: Zimbra CVE-2026-73570 exploitation artifacts (Sentinel)
// Looks for callback DNS/connections, webshell-adjacent process spawns, and known payload hashes
let callbackHosts = dynamic(["psk1zim.abrdns.com", "tls.psk1zim.abrdns.com"]);
let payloadHashes = dynamic([
"dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a",
"aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d",
"6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244",
"bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf",
"b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159"
]);
union isfuzzy=true
( DeviceNetworkEvents
| where TimeGenerated >= ago(120d)
| where RemoteUrl has_any (callbackHosts) or RemoteIP in (
toscalar(DnsEvents | where TimeGenerated >= ago(120d)
| where Name has_any (callbackHosts)
| summarize by tostring(IPAddresses)))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort ),
( DeviceProcessEvents
| where TimeGenerated >= ago(120d)
| where (InitiatingProcessFileName has_any ("java", "zimbra", "zmcontrol")
and FileName in~ ("bash", "sh", "curl", "wget", "nc", "ncat", "perl", "python", "python3"))
or SHA256 in~ (payloadHashes)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256 ),
( DnsEvents
| where TimeGenerated >= ago(120d)
| where Name has_any (callbackHosts)
| project TimeGenerated, ClientIP, Name, IPAddresses )
| sort by TimeGenerated desc
Bash / Shell
#!/bin/bash
# Zimbra CVE-2026-73570 compromise assessment script (run on suspected Zimbra hosts)
# Checks for webshells, suspicious webapp modifications, callback DNS history, and reverse-shell artifacts
echo "=== [1] JSP files modified under Zimbra webapps since 2026-07-01 ==="
find /opt/zimbra/jetty*/webapps/ -name '*.jsp' -newermt '2026-07-01' -ls 2>/dev/null
echo "=== [2] Known payload hashes (SHA256 sweep of webapp dirs) ==="
declare -a HASHES=(
"dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a"
"aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d"
"6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244"
"bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf"
"b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159"
)
find /opt/zimbra/jetty*/webapps/ -name '*.jsp' -exec sha256sum {} \; 2>/dev/null | \
while read -r sum file; do
for h in "${HASHES[@]}"; do
[[ "$sum" == "$h" ]] && echo "!! HASH MATCH: $file ($sum)"
done
done
echo "=== [3] Suspicious child processes historically spawned by zimbra user ==="
grep -iE 'zimbra' /var/log/audit/audit.log* 2>/dev/null | grep -iE 'bash|/bin/sh|curl|wget|nc |perl|python' | tail -50
echo "=== [4] Callback hostname evidence in logs ==="
grep -riE 'psk1zim\.abrdns\.com|abrdns\.com' /var/log/ 2>/dev/null | tail -20
echo "=== [5] Active outbound connections from zimbra-owned processes ==="
ss -tupn 2>/dev/null | grep -i zimbra | grep -vE 'ESTAB.*(25|80|443|389|636|7071|7143)/'
echo "=== [6] Reverse-shell one-liner artifacts in shell histories ==="
find /opt/zimbra /home -name '.*history' -exec grep -lE 'bash -i|/dev/tcp/|nc -e|socket\(' {} \; 2>/dev/null
echo "=== [7] Zimbra patch level ==="
su - zimbra -c 'zmcontrol -v' 2>/dev/null || echo "Unable to determine version"
echo "Assessment complete. Any findings in sections 1-6 warrant incident response escalation."
Response Priorities
Immediate (0-4 hours)
- Confirm every Zimbra Collaboration Suite instance is patched against CVE-2026-73570; isolate any unpatched internet-facing server from the network and treat it as compromised pending forensic review.
- Block
psk1zim.abrdns.com,tls.psk1zim.abrdns.com, and parent domainabrdns.comat DNS resolvers and egress proxies; push the five SHA256 hashes to EDR prevention. - Run the bash assessment script on all Zimbra hosts; any JSP created/modified in webapp directories since July 2020-patch window is suspect.
- Snapshot/ preserve volatile evidence (memory,
jettylogs,/var/log/zimbra*.log, auditd) before remediation on suspect hosts.
24 Hours
- Rotate all credentials stored on or accessible from Zimbra servers: LDAP bind accounts, MySQL credentials in
localconfig.xml, admin accounts, and any service accounts with mail-server logons. - Force password resets for mailbox users on any confirmed-compromised server; review mailbox forwarding rules, delegates, and OAuth grants for attacker-established persistence.
- Retro-hunt DNS, proxy, and EDR telemetry back to July 20, 2026 for callback hostnames and webshell access patterns (single-source POSTs to obscure JSP paths).
- Audit outbound mail flow for signs of the server being used as a phishing relay post-compromise.
1 Week
- Rebuild any confirmed-compromised Zimbra host from known-good media; do not clean in place.
- Architecturally isolate mail infrastructure: restrict outbound internet access from Zimbra servers to required destinations only (egress allow-listing), and segment mail servers from identity systems.
- Deploy file-integrity monitoring on all webapp directories and web-content anomaly detection on reverse proxies/WAFs fronting Zimbra.
- Add SNMP-path and webshell behavioral detections (process-spawn-from-webapp, JSP creation) to permanent SIEM correlation; subscribe to the OTX pulse for indicator updates as the campaign evolves.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.