# MA-886.112022: MyCERT Advisory - Updates Advisory on Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite

**Date:** 11 Nov 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-886.112022  
**Advisory ID:** MA-886.112022

---

**1.0 Introduction**
Recently, there were reports regarding the active exploitation of multiple Common Vulnerabilities and Exposures (CVEs) against Zimbra Collaboration Suite (ZCS), an enterprise cloud-hosted collaboration software and email platform. MyCERT has previously posted an advisory regarding these reported vulnerabilities and this is an update to the previous advisory with additional findings.
The previous advisory can be viewed via the following URL: 
<https://www.mycert.org.my/portal/advisory?id=MA-870.102022>
<https://www.mycert.org.my/portal/advisory?id=MA-875.102022>
**2.0 Indicators of Compromise**
Three Java Server Pages (JSP) webshells were analyzed from an organization where cyber actors exploited vulnerabilities against Zimbra Collaboration Suite (ZCS). Four CVEs are currently being leveraged against ZCS: CVE-2022-24682, CVE-2022-27924, CVE-2022-27925 chained with CVE-2022-37042, and CVE-2022-30333. The files are server-side codes that allows clients to remotely send commands to be executed on the victim web server.
Identified Files Hash (SHA256) (3)
14bf0cbee88507fb016d01e3ced053858410c389be022d2aa4d075287c781c4a (hiall.jsp)
814a169ba97b168f95af3340b60a6fec1f29c87be89226b1966d9b0abfb19a15 (aes.jsp)
bc5b1f588cd506a69c03a7980a363846fa474b78e6946fa90e58d735c65f2bb6 (cmd.jsp)
More details regarding the identified malicious files can be accessed here: [https://www.cisa.gov/uscert/nunfavourablecas/analysis-reports/ar22-314a](https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-314a)
**3.0 Affected Products**
• Zimbra Collaboration Suite (ZCS)
**4.0 Recommendations**
Users and administrators are recommended to take the mitigation steps below as soon as possible:
- Maintain up-to-date antivirus signatures and engines.
- Keep operating system patches up-to-date.
- Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
- Restrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local administrator's group unless required.
- Enforce a strong password policy and implement regular password changes.
- Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
- Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
- Disable unnecessary services on agency workstations and servers.
- Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
- Monitor users' web browsing habits; restrict access to sites with unfavorable content.
- Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
- Scan all software downloaded from the Internet prior to executing.
- Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
<https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-314a>