Date: 10/01/2026
Severity: High
Summary
Researchers details active exploitation of CVE-2026-73570, an unauthenticated OS command-injection vulnerability in the Zimbra Collaboration Suite SNMP notification path, allowing attackers to execute commands on internet-facing servers without authentication. Observed attacks deployed JSP web shells, reverse shells, persistence mechanisms, privilege escalation, and memory-backed payloads. Attackers also performed credential and mailbox-data collection, lateral movement across Zimbra clusters, and attempted cloud-based data exfiltration.
Indicators of Compromise (IOC) List
Domain/URLs | mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws.com/pakistan/2026/aliyun_update.tar.gz psk1zim.abrdns.com tls.psk1zim.abrdns.com transzimbra.linkpc.net wslogzimbra.linkpc.net |
IP Address | 117.107.25.243 192.255.193.111 193.42.40.135 3.209.137.175 45.32.30.235 |
Hash | dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a
aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d
6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244
bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf
b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159
65A7576C389326B6CDF9C993D0BE6E5D50FED9655D1CDF2A3A50F2C21C8EC435
22EF852F6EBC39EE71235B90648B4B200B385C47D25C79545986493F8C70DB69
518FE65DD349180191D9B258AB24876AAED6613CD657D0B626D1FC24E03A22B6
|
Public GitHub release | github.com/<redacted>/lpe-toolkit |
Base Contract address | 0x25bdA7Feb3553995AD68a9A8Ed8c731b73a71586 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "tls.psk1zim.abrdns.com" or url like "tls.psk1zim.abrdns.com" or siteurl like "tls.psk1zim.abrdns.com" or domainname like "mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws.com/pakistan/2026/aliyun_update.tar.gz" or url like "mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws.com/pakistan/2026/aliyun_update.tar.gz" or siteurl like "mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws.com/pakistan/2026/aliyun_update.tar.gz" or domainname like "psk1zim.abrdns.com" or url like "psk1zim.abrdns.com" or siteurl like "psk1zim.abrdns.com" or domainname like "wslogzimbra.linkpc.net" or url like "wslogzimbra.linkpc.net" or siteurl like "wslogzimbra.linkpc.net" or domainname like "transzimbra.linkpc.net" or url like "transzimbra.linkpc.net" or siteurl like "transzimbra.linkpc.net" |
Detection Query 2 : | dstipaddress IN ("45.32.30.235","3.209.137.175","117.107.25.243","193.42.40.135","192.255.193.111") or srcipaddress IN ("45.32.30.235","3.209.137.175","117.107.25.243","193.42.40.135","192.255.193.111") |
Detection Query 3 : | sha256hash IN ("b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159","bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf","65A7576C389326B6CDF9C993D0BE6E5D50FED9655D1CDF2A3A50F2C21C8EC435","22EF852F6EBC39EE71235B90648B4B200B385C47D25C79545986493F8C70DB69","518FE65DD349180191D9B258AB24876AAED6613CD657D0B626D1FC24E03A22B6","dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a","aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d","6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244")
|
Reference:
https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/