Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Hackers Exploit Zimbra CVE-2026-73570 With Crafted Emails to Execute Commands Without Authentication
Excerpt
Threat Intelligence has identified active exploitation of CVE-2026-73570, a serious unauthenticated command-injection vulnerability in Zimbra Collaboration Suite. The flaw allows attackers to execute operating-system commands on exposed mail servers by sending specially crafted emails. The vulnerability affects Zimbra installations with the optional zimbra-snmp package installed and SNMP notifications enabled. No authentication or user interaction is required. Attackers…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 117.107.25.243 | High | Score 64/100 | First seen |
| CVE | CVE-2026-73570 | High | Score 74/100 | First seen |
IOC Relationship Graph
Building graph…