ZIMBRA 0-DAY USED TO TARGET INTERNATIONAL GOVERNMENT ORGANIZATIONS

Summary from the TLDR InfoSec newsletter

Google TAG discovered an exploit in the Zimbra email server 0-day (CVE-2023-37580) in the wild. It was used by 4 groups to steal emails, credentials, and tokens even after a public fix was released. This post-disclosure activity shows that delays leave orgs vulnerable. It urges rapid patching and updates to protect against ongoing exploits of known bugs.