Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Malware Families
Excerpt
An enterprise mail server authenticates users, stores private communications, delivers recovery links, runs calendars, and sends mail that employees and other systems trust. Compromising it can therefore expose both email and the identities and workflows built around it. During a broader assessment of Zimbra Collaboration Suite (ZCS), Rapid7 reported more than 80 vulnerabilities spanning authentication, mailbox authorization, calendar processing, web clients, document…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-93635 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-50055 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-93637 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-73571 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-10631 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-50054 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…