Zimbra

Chinese Cybercriminals Deploy AI Agents to Automate Exploitation of Exposed Windows and Linux Servers

A Chinese cybercriminal group tracked as UAT-10147 is actively using AI agents to automate reconnaissance, exploitation, and post-exploitation against internet-facing Windows and Linux servers. Cisco Talos identified the campaign after discovering approximately 170,000 URLs in the attackers' infrastructure, with targets spanning government, education, media, technology, and gaming organizations across multiple countries including Brazil. The group divides targets into smaller batches to accelerate scanning and exploitation of known vulnerabilities in applications such as Zimbra, AjaxPro, Nacos, and Telerik. AI agents go beyond simple code generation by producing exploitation guides, refining failed attacks, verifying payload success, and automating persistence and post-exploitation steps. In one observed case, the agents created scripts capable of validating permissions, exploiting ViewState deserialization, installing implants, and deploying web shells on compromised IIS servers. Cisco Talos assesses the operation as a shift toward semi-autonomous offensive orchestration rather than basic AI-assisted scripting.

CISA Adds Zimbra Collaboration Suite CVE-2026-73570 to KEV Catalog After Confirmed Exploitation

US authorities have issued a warning about active exploitation of a vulnerability in the Zimbra Collaboration Suite. CISA added the OS command injection flaw CVE-2026-73570 to its Known Exploited Vulnerabilities catalog on August 21, 2026, marking the fifth such entry for the year. The issue resides in the SNMP monitoring component and allows unauthenticated attackers to execute arbitrary operating system commands with Zimbra user privileges when SNMP notifications are enabled. MITRE rated the vulnerability 8.9 on CVSS v3.1, classifying it as High severity. Federal agencies must apply mitigations by August 24, while all organizations using the product are urged to prioritize patching to prevent further abuse.

Russian State-Supported Group LAUNDRY BEAR Exploits Zero-Day CVE-2025-66376 in Zimbra Collaboration Suite

Synacor’s Zimbra Collaboration Suite was targeted in a zero-day campaign by the Russian state-backed threat actor known as LAUNDRY BEAR. The stored cross-site scripting flaw in the webmail stylesheet handler allowed attackers to steal past emails simply by having victims view a specially crafted HTML message. No user interaction beyond opening the email was required for JavaScript execution in the browser. On 23 July 2026, sixteen countries including the United States, European nations and Australia issued a joint advisory signed by twenty-seven agencies such as NSA, FBI and CISA. The vulnerability received CVE-2025-66376 and a CVSS v3.1 base score of 7.2, rated High. Analysts assess the campaign focused on intelligence collection against Western government and corporate targets.