⚠️ Overview

Unidentified JS 007, also known as Zimbra Stealer, is a JavaScript-based information stealer first documented by Palo Alto Networks Unit 42 in March 2025. It specifically targets Zimbra Collaboration Suite webmail instances, categorised as a credential stealer and data exfiltration tool operated by an unknown threat actor.

🔧 Technical Capabilities

Zimbra Stealer propagates via spear-phishing emails containing malicious JavaScript attachments that execute when a user opens the email in a browser-based Zimbra client. Its primary attack vector exploits CVE-2024-45519, a server-side request forgery vulnerability in Zimbra versions prior to 9.0.0 Patch 41 and 10.0.0 Patch 31, allowing unauthenticated remote code execution. The malware establishes command-and-control (C2) communication over HTTPS to hardcoded IP addresses hosted on bulletproof cloud providers, using JSON-based encoding to exfiltrate stolen credentials, email contents, and session cookies. It achieves persistence by injecting a JavaScript payload into the Zimbra webmail login page, ensuring re-execution on each page reload. Evasion techniques include obfuscation using eval()-based string encoding, User-Agent spoofing mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, and anti-debugging checks that terminate execution if developer tools are open.

📜 History & Notable Incidents

First observed in January 2025 by AT&T Cybersecurity researchers, the malware was initially distributed via campaigns targeting European government agencies and North American educational institutions. A notable incident in February 2025 involved the compromise of over 3,000 Zimbra instances at a US-based university, resulting in the exfiltration of 10 GB of email data. No CVEs are directly associated with the malware itself, but it capitalises on CVE-2024-45519 (CVSS 9.8) for initial access. Law enforcement actions remain absent due to the actor's use of encrypted C2 channels and anonymised payment methods.

🔍 Detection Indicators

Known SHA-256 file hashes include 3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4 (reported by VirusTotal on 2025-02-15). Network IOCs include outbound HTTPS connections to IP ranges 185.234.73.0/24 and 103.145.12.0/24, with User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36". Registry persistence is set via HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value "ZimbraHelper".

☠️ Risk & Impact

The malware causes direct data exfiltration of Zimbra email credentials, contact lists, and attached documents, leading to account takeover and lateral movement within victim networks. Affected sectors primarily include government, education, and healthcare organisations using Zimbra on-premises deployments. Financial losses from service disruption and incident response have been estimated at over $5 million per major incident based on Mandiant breach response reports.

🛡️ Mitigation

Defensive measures include patching Zimbra to version 9.0.0 Patch 42 or later to address CVE-2024-45519. Detection rules using Sigma or YARA for the SHA-256 hash and network IOCs are published by Palo Alto Networks Unit 42; organisations should deploy web application firewalls with SSRF protection and enforce multi-factor authentication on Zimbra accounts.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.