Context: A New Kind of Email Threat Hits Western Targets

According to a recent report from The Hacker News, a Russian state-backed espionage group spent months breaking into Western mailboxes using a flaw in Zimbra, a popular email platform. The attack did not require the victim to click a link or download a file — simply viewing the malicious message in a web browser was enough to trigger the exploit. That makes this a "zero-click" threat, which is especially dangerous because many people still believe opening an email is safe.

This campaign targeted government agencies, defence contractors, and even nuclear facilities in NATO countries and beyond. The attackers stole emails, passwords saved in browsers, and two-factor authentication recovery codes. For Australian businesses that rely on email for daily operations, this story is a wake-up call. The techniques used here can easily be adapted to hit smaller targets that lack dedicated security teams.

Why This Attack Changes the Game for Email Security

The exploit worked by hiding malicious code inside an email's HTML structure. Zimbra's security tools could not recognise the broken pieces of code as a threat, so the message passed through. Once opened, the code reassembled itself inside the browser and stole data silently. This is a reminder that even trusted software can have blind spots that attackers know how to abuse.

What makes this case especially troubling is that the group exploited the flaw as a "zero-day" — meaning Zimbra had no patch available when the attacks began. The company fixed it later, but by then the attackers had already stolen credentials and access tokens. For Australian SMBs, this shows the importance of not just patching quickly, but also preparing for the possibility that a patch may come too late. A proactive security posture, not just reactive updates, is essential.

What This Means for Australian SMBs

Many small and mid-sized Australian businesses use Zimbra or similar open-source email platforms to keep costs down. This attack proves that cybercriminals and state-sponsored groups are willing to invest time in targeting these widely used systems. If the attackers can compromise government agencies, they can certainly break into a small accounting firm or a regional logistics company that has not updated its software.

The stolen data — especially two-factor recovery codes — can let attackers bypass your strongest security layer. Once they have those codes, they can log into your email from anywhere, read your client's messages, and even send fake invoices. For an Australian SMB, that could mean financial fraud, data loss, and a serious hit to customer trust.

What You Can Do Now

Take these practical steps to reduce your risk:

  • Update your Zimbra installation immediately. Make sure you are running at least version 10.1.13 or later. If you are on Zimbra 10.0, plan an upgrade to a supported 10.1 build right away, as the old version has reached its end of life.
  • Reset all user passwords and revoke app-specific passwords. The attackers may have created hidden credentials that survive a normal password change. Look for any credential named "ZimbraWeb" in your system logs and remove it.
  • Check for unusual IMAP access. If your users do not need IMAP access, disable it. Review logs for accounts that have IMAP suddenly enabled — that is a common sign of compromise.
  • Monitor logs for suspicious API calls. Look for requests to "CreateAppSpecificPassword" or "GetScratchCodesRequest". These are unusual in normal use and indicate an attacker is inside.
  • Implement stronger two-factor authentication. Move away from SMS-based codes or scratch codes. Use hardware tokens or authenticator apps that are harder to steal remotely.

If this all sounds overwhelming, MS&VG can help your Australian business review your email security setup, check for signs of compromise, and build a practical defence plan. You do not have to face these evolving threats alone.