Ankura CTIX FLASH Update - August 22, 2023

Malware Activity

New Social Engineering Campaign Targeting Zimbra Collection Users

Researchers have uncovered a "mass-spreading" social engineering campaign targeting Zimbra users within small and medium businesses as well as government entities. The campaign has been observed targeting entities primarily in Poland, Ecuador, and Italy, and targets users of the Zimbra Collection platform, which is an "open-core collaborative software platform" that is a common enterprise email alternative. The threat actor responsible for the campaign has yet to be attributed and the goal appears to be collecting account credentials. Campaign targets receive a phishing email with a warning about an email server update, account deactivation, or similar issue and prompts the user to open an attached HTML file containing a phishing page. The sender is spoofed to appear as an email server administrator. Once the attached file is clicked, the file is opened in the victim's browser and