Zimbra Post-Exploitation and Cluster Exfiltration

Source

---
analysis: A single rule on zmlocalconfig may be too noisy or easily bypassed by grepping
  localconfig.xml directly; this hunt correlates harvesting, cluster-wide SSH movement,
  and anomalous Go binary execution into a single high-confidence verdict.
blind_spots:
- id: missing-process-telemetry
  question: whether commands ran on nodes without telemetry agents
  requires: hb_process_activity on all mail cluster nodes
  risk: An attacker can move to an unmonitored node in the cluster and perform exfiltration
    there without being recorded.
- id: encrypted-c2-content
  question: the specific commands sent over the openssl s_client tunnel
  requires: Network TLS decryption
  risk: While the shell activity is visible as a process, the exact content of the
    commands and exfiltrated data remains hidden.
  stage: multi-stage-go-implant-c2
coverage:
- stage: zimbra-credential-harvesting
  status: covered
  steps:
  - credential-harvesting
- stage: lateral-movement-via-ssh
  status: covered
  steps:
  - cluster-lateral-movement
- stage: multi-stage-go-implant-c2
  status: covered
  steps:
  - follow-on-implants
- stage: mailbox-and-auth-exfiltration
  status: covered
  steps:
  - exfiltration-staging
- reason: 'Belongs to another part of the ''Unauthenticated command injection on internet-facing
    mail servers: tracking CVE-2026-73570'' series.'
  stage: unauthenticated-rce-snmp-path
  status: out_of_scope
- reason: 'Belongs to another part of the ''Unauthenticated command injection on internet-facing
    mail servers: tracking CVE-2026-73570'' series.'
  stage: webshell-deployment-and-reconstruction
  status: out_of_scope
- reason: 'Belongs to another part of the ''Unauthenticated command injection on internet-facing
    mail servers: tracking CVE-2026-73570'' series.'
  stage: zimbra-environment-reconnaissance
  status: out_of_scope
- reason: 'Belongs to another part of the ''Unauthenticated command injection on internet-facing
    mail servers: tracking CVE-2026-73570'' series.'
  stage: pam-abuse-privilege-escalation
  status: out_of_scope
- reason: 'Belongs to another part of the ''Unauthenticated command injection on internet-facing
    mail servers: tracking CVE-2026-73570'' series.'
  stage: systemd-service-persistence
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: Zimbra servers contain the organization's entire communication history
    and authentication secrets; confirmed post-exploitation activity here represents
    a total data breach scenario requiring immediate response.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An attacker who has compromised a Zimbra server is harvesting service
  credentials and moving laterally to peer nodes using the Zimbra SSH identity to
  exfiltrate mailbox data via specialized Go implants.
labels:
- hunt
- attack.t1552.004
- attack.t1003
- attack.t1021.004
- attack.t1105
- attack.t1071.001
- attack.t1564.010
- attack.t1041
- attack.t1560
- command and control
- credential access
- discovery
- exfiltration
- initial access
- lateral movement
- persistence
- privilege escalation
name: Zimbra Post-Exploitation and Cluster Exfiltration
parameters:
  lookback_days:
    default: '14'
    description: Days of history to examine.
    from:
      kind: manual
      observed: '2026-09-30'
      ref: hunt-config
    type: number
  scope_hosts:
    default: []
    description: Hostnames identified in the scoping step; leave empty to hunt the
      whole estate.
    from:
      kind: manual
      observed: '2026-09-30'
      ref: hunt-config
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Start with servers running Zimbra (Mailbox nodes, MTAs). Use the identified
  hosts to populate the scope_hosts parameter for subsequent steps.
references:
- name: 'Microsoft Security Blog: Unauthenticated command injection on internet-facing
    mail servers: tracking CVE-2026-73570'
  url: https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/
related:
- hunt: zimbra-unauth-rce-initial-access
  reason: This hunt focuses on the post-exploitation phase after the initial RCE exploit.
  relation: follows
scenario:
  stages:
  - name: Unauthenticated RCE via SNMP path
    observables:
    - CVE-2026-73570
    - swatchdog
    - snmptrap
    - ZB73570 User-Agent
    - oast.fun
    - oast.online
    - dnslog.pp.ua
    - requestrepo.com
    - bypass.eu.org
    slug: unauthenticated-rce-snmp-path
    tactic: initial-access
    techniques:
    - T1190
    - T1059.004
  - name: Webshell deployment and reconstruction
    observables:
    - JSP webshells in Jetty application paths
    - JSP webshells in mailboxd application paths
    - Payload reconstruction from staged fragments
    - webroot permission modification
    slug: webshell-deployment-and-reconstruction
    tactic: persistence
    techniques:
    - T1505.003
    - T1027
  - name: Zimbra environment reconnaissance
    observables:
    - zmprov to map mailbox nodes
    - zmprov to map MTA nodes
    - Checking /opt/zimbra/.ssh/zimbra_identity
    slug: zimbra-environment-reconnaissance
    tactic: discovery
    techniques:
    - T1082
    - T1087
  - name: PAM abuse privilege escalation
    observables:
    - Symlink zmmailboxd.out -> /etc/pam.d/sudo
    - zmmailboxdmgr invocation
    - pam_exec session hook
    - zmstat-fd invocation
    - 'NOPASSWD: ALL added to sudoers'
    slug: pam-abuse-privilege-escalation
    tactic: privilege-escalation
    techniques:
    - T1548.003
    - T1556
  - name: Systemd service persistence
    observables:
    - /etc/systemd/system/zimlog.service
    - timestomping to match rsync.service
    - timestomping to match sshd.service
    - systemctl enable zimlog.service
    slug: systemd-service-persistence
    tactic: persistence
    techniques:
    - T1543.002
    - T1070.006
  - name: Zimbra credential harvesting
    observables:
    - zmlocalconfig -s
    - ldapsearch for zimbraPreAuthKey
    - ldapsearch for zimbraAuthTokenKey
    - ldapsearch for zimbraTwoFactorAuthSecret
    slug: zimbra-credential-harvesting
    tactic: credential-access
    techniques:
    - T1552.004
    - T1003
  - name: Lateral movement via SSH
    observables:
    - ssh -i /opt/zimbra/.ssh/zimbra_identity
    - StrictHostKeyChecking=no
    - rsync to peer mailbox nodes
    slug: lateral-movement-via-ssh
    tactic: lateral-movement
    techniques:
    - T1021.004
  - name: Multi-stage Go implant C2
    observables:
    - agent2.sh downloader
    - zimdown2 installer
    - zimclient2 agent
    - named pipe /tmp/s
    - openssl s_client to remote endpoint
    - memfd_create execution
    slug: multi-stage-go-implant-c2
    tactic: command-and-control
    techniques:
    - T1105
    - T1071.001
    - T1564.010
  - name: Mailbox and auth exfiltration
    observables:
    - zimbra-exfil/client-dump module
    - hidden archive creation for exfiltration
    slug: mailbox-and-auth-exfiltration
    tactic: exfiltration
    techniques:
    - T1041
    - T1560
  summary: An unauthenticated RCE campaign exploiting CVE-2026-73570 in Zimbra's SNMP
    notification path to execute commands as the zimbra user. Attackers deployed JSP
    webshells, escalated to root by abusing pam_exec and sudo helpers, and utilized
    custom Go-based agents to exfiltrate service authentication keys and mailbox data.
series:
  index: 3
  slug: unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570
  title: 'Unauthenticated command injection on internet-facing mail servers: tracking
    CVE-2026-73570'
  total: 3
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
tlp: clear
type: investigation
---


# Zimbra Post-Exploitation and Cluster Exfiltration

This hunt focuses on the late-stage actions following the exploitation of CVE-2026-73570. It examines the harvest of high-value authentication keys from local configurations, the use of shared SSH identities to move laterally across the mail cluster, and the deployment of advanced Go-based agents. The hunt follows a phased approach: first identifying the mail cluster servers, then triaging early movement and credential theft, and finally searching for the complex implants and exfiltration staging files. By looking for anomalous execution within the Zimbra directory structure and openssl-backed encrypted shells, this hunt distinguishes targeted server compromise from generic scanning activity.

## identify-zimbra-hosts
<!-- Identify Zimbra Servers -->
Identify the mail cluster by finding hosts with Zimbra software installed to narrow the hunt scope.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of hostnames belonging to the mail cluster. Silence means no Zimbra
  software is recorded in inventory.
reads:
- device_hostname
- package_name
- package_version
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-10-20'
~~~
SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%zimbra%'
```

## parallel-early-activity
<!-- Examine Early Activity -->
parallel:
- → credential-harvesting
- → cluster-lateral-movement
join: → triage-early-evidence

## credential-harvesting
<!-- Zimbra Credential Harvesting -->
Detect usage of Zimbra tools or manual inspection of configuration files to dump service credentials.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Process command lines showing the zimbra user dumping global configuration
  or authentication secrets. Silence means no such commands were captured.
reads:
- device_hostname
- user_name
- process_cmd_line
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-10-20'
~~~
SELECT device_hostname, user_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%zmlocalconfig -s%' OR LOWER(process_cmd_line) LIKE '%zimbrapreauthkey%' OR LOWER(process_cmd_line) LIKE '%zimbraauthtokenkey%' OR LOWER(process_cmd_line) LIKE '%zimbratwofactorauthsecret%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## cluster-lateral-movement
<!-- Cluster Lateral Movement -->
Identify lateral movement by searching for usage of the shared Zimbra SSH identity across the cluster.

```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: SSH or rsync commands using the Zimbra identity file that appear on only
  one or two hosts. Silence means no rare cluster-wide SSH activity was seen.
prevalence:
  by: device_hostname
  key:
  - process_cmd_line
  rare_below: 3
reads:
- process_cmd_line
- device_hostname
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-10-20'
~~~
SELECT process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%/opt/zimbra/.ssh/zimbra_identity%' OR LOWER(process_cmd_line) LIKE '%stricthostkeychecking=no%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_cmd_line HAVING host_count <= 2
```

## triage-early-evidence
<!-- Triage Early Evidence -->
```agent target=hunter
cite: required
context:
- credential-harvesting
- cluster-lateral-movement
max_iterations: 3
objective: Determine if the zmlocalconfig usage or SSH identity usage is consistent
  with an attacker moving between nodes or harvesting secrets.
success_criteria: A verdict of malicious | suspicious | benign per host citing the
  command patterns.
tools:
- endpoint
```

## parallel-follow-on-activity
<!-- Follow-on Activity Search -->
parallel:
- → follow-on-implants
- → exfiltration-staging
join: → triage-final-intrusion

## follow-on-implants
<!-- Follow-on Implants -->
Detect anomalous binary execution from within /opt/zimbra/ subdirectories and encrypted shells.

```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Processes running from non-standard Zimbra paths or openssl sessions used
  as reverse shells. Silence means no anomalous Zimbra-user execution was found.
reads:
- device_hostname
- user_name
- process_path
- process_cmd_line
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-10-20'
~~~
SELECT device_hostname, user_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_path) LIKE '/opt/zimbra/%' AND LOWER(process_path) NOT LIKE '/opt/zimbra/bin/%' AND LOWER(process_path) NOT LIKE '/opt/zimbra/libexec/%' AND LOWER(process_path) NOT LIKE '/opt/zimbra/common/%' OR (LOWER(process_cmd_line) LIKE '%openssl s_client%' AND LOWER(process_cmd_line) LIKE '%/tmp/s%') OR (LOWER(process_cmd_line) LIKE '%memfd_create%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## exfiltration-staging
<!-- Exfiltration Staging -->
Search for the creation of hidden archives or temporary data fragments by the Zimbra process.

```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Creation of archives in /tmp or hidden directories by Zimbra-associated
  processes. Silence means no suspicious file staging was seen.
reads:
- device_hostname
- actor_user_name
- file_path
- file_name
- time
silence: not_evidence_of_absence
source: hb_file_activity
verified: dry-run
verified_at: '2026-10-20'
~~~
SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%/tmp/.%' OR LOWER(file_name) LIKE '%.tar.gz' OR LOWER(file_name) LIKE '%.zip' OR LOWER(file_name) LIKE '%.7z') AND (LOWER(process_name) LIKE '%zimbra%' OR LOWER(actor_user_name) = 'zimbra') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## triage-final-intrusion
<!-- Final Intrusion Triage -->
```agent target=hunter
cite: required
context:
- triage-early-evidence
- follow-on-implants
- exfiltration-staging
max_iterations: 5
objective: Weigh the Phase 1 movement and harvest against the Phase 2 agents and staging
  activity to confirm a completed mailbox exfiltration operation.
success_criteria: A final verdict citing the linkage between initial harvest and follow-on
  agent deployment.
tools:
- endpoint
```

## decision-route
<!-- Route on Intrusion Verdict -->
if~: "the triage-final-intrusion verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → isolate-compromised-node
indeterminate: → analyst-forensic-review
unavailable: → analyst-forensic-review (blind_spot: missing-process-telemetry)
else: → close-out-negative

## isolate-compromised-node
<!-- Isolate Compromised Node -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host from the network. Revoke the Zimbra SSH identity across the entire cluster and rotate all LDAP, Postfix, and service account credentials immediately.
```
→ analyst-forensic-review

## analyst-forensic-review
<!-- Analyst Forensic Review -->
```manual target=analyst
Examine the /opt/zimbra/ directory for binaries running as the zimbra user that do not belong to the standard install. Verify the other hosts in the mail cluster for the presence of the same SSH identity usage or hidden archive files.
```
→ end

## close-out-negative
<!-- Close Out Negative -->
```manual target=analyst
Record that no evidence of Zimbra credential harvesting or follow-on implant activity was found. Recommend verifying that the zimbra-snmp package is either updated or disabled.
```
→ end