# MA-875.102022: MyCERT Advisory - Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite

**Date:** 22 Oct 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-875.102022  
**Advisory ID:** MA-875.102022

---

**1.0 Introduction**
Recently, there were reports regarding the active exploitation of multiple Common Vulnerabilities and Exposures (CVEs) against Zimbra Collaboration Suite (ZCS), an enterprise cloud-hosted collaboration software and email platform. MyCERT has previously posted an advisory regarding these reported vulnerabilities and this is an update to the previous advisory with additional findings. 
The previous advisory can be viewed via the following URL: <https://www.mycert.org.my/portal/advisory?id=MA-870.102022>
**2.0 Indicators of Compromise**
Four CVEs are currently being leveraged against ZCS: CVE-2022-24682, CVE-2022-27924, CVE-2022-27925 chained with CVE-2022-37042, and CVE-2022-30333. The executable file is designed to side-load a malicious DLL file. The DLL is designed to load and Exclusive OR (XOR) decrypt the encrypted file. The decrypted file contains a Cobalt Strike Beacon binary. The Cobalt Strike Beacon is a malicious implant on a compromised system that calls back to the command and control (C2) server and checks for additional commands to execute on the compromised system.
**Identified Files Hash (SHA256) (3)**
- 233bb85dbeba69231533408501697695a66b7790e751925231d64bddf80bbf91 (bin.config)
- 25da610be6acecfd71bbe3a4e88c09f31ad07bdd252eb30feeef9debd9667c51 (VFTRACE.dll)
- df847abbfac55fb23715cde02ab52cbe59f14076f9e4bd15edbe28dcecb2a348 (vxhost.exe)
**Additional Files Hash (SHA256) (1)**
- 3450d5a3c51711ae4a2bdb64a896d312ba638560aa00adb2fc1ebc34bee9369e (Extracted\_CobaltStrike\_Beacon)
**IPs (1)**
- 207.148.76.235
More details of the Indicators of Compromise (IoCs) can be viewed here:
<https://www.cisa.gov/uscert/sites/default/files/publications/MAR-10398871.r1.v2.WHITE.pdf>
**3.0 Affected Products**
• Zimbra Collaboration Suite (ZCS)
**4.0 Recommendations**
Users and administrators are recommended to take the mitigation steps below as soon as possible:
• Patch all systems and prioritize patching known exploited vulnerabilities.
• Organizations that did not immediately update their ZCS instances upon patch release are advised to deploy detection signatures and hunt for malicious activities and indicators of compromise (IOCs).
• If ZCS was compromised, eradicate the malicious activities immediately and rectify the compromised server.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
• <https://www.cisa.gov/uscert/ncas/current-activity/2022/10/19/cisa-updates-advisory-threat-actors-exploiting-multiple-cves>
• <https://www.cisa.gov/uscert/ncas/alerts/aa22-228a>
• <https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-292a>