Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
23 IOCs
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
Malware Families
Excerpt
In this article Attack chain overview Mitigation and protection guidance References Learn More Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570 , an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. Exploitation can be triggered by a specially crafted email against internet-facing Zimbra servers when the optional zimbra-snmp package is installed and SNMP notifications are enabled,…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →23 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 518fe65dd349180191d9b258ab24876aaed6613cd657d0b626d1fc24e03a22b6 | Medium | Score 53/100 | First seen |
| SHA256 | dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a | Medium | Score 53/100 | First seen |
| SHA256 | aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d | Medium | Score 53/100 | First seen |
| IP | 193.42.40.135 | High | Score 58/100 | First seen |
| IP | 192.255.193.111 | High | Score 58/100 | First seen |
| URL | https://aka.ms/threatintelblog | High | Score 58/100 | First seen |
| SHA256 | bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf | Medium | Score 53/100 | First seen |
| Domain | requestrepo.com | High | Score 74/100 | First seen |
| SHA1 | 25bda7feb3553995ad68a9a8ed8c731b73a71586 | Medium | Score 53/100 | First seen |
| IP | 3.209.137.175 | High | Score 58/100 | First seen |
| URL | https://aka.ms/downloadazcopy-v10-linux | High | Score 58/100 | First seen |
| SHA256 | 6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244 | Medium | Score 53/100 | First seen |
| Domain | oast.online | High | Score 58/100 | First seen |
| IP | 45.32.30.235 | High | Score 58/100 | First seen |
| Domain | oast.fun | Medium | Score 54/100 | First seen |
| IP | 117.107.25.243 | High | Score 64/100 | First seen |
| CVE | CVE-2026-73570 | High | Score 74/100 | First seen |
| SHA256 | 22ef852f6ebc39ee71235b90648b4b200b385c47d25c79545986493f8c70db69 | Medium | Score 53/100 | First seen |
| Domain | dnslog.pp.ua | High | Score 58/100 | First seen |
| SHA256 | b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159 | Medium | Score 53/100 | First seen |
| Domain | bypass.eu.org | High | Score 58/100 | First seen |
| Domain | transzimbra.linkpc.net | High | Score 58/100 | First seen |
| SHA256 | 65a7576c389326b6cdf9c993d0be6e5d50fed9655d1cdf2a3a50f2c21c8ec435 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…