Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE14 IOCs
TA488 Targets Zimbra Mailservers with Half-Click Exploits
Threat Actors
Malware Families
Diamond Model
Adversary(3)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
14 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | istc-cloud.com | High | Score 58/100 | First seen |
| SHA256 | 60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874 | Medium | Score 53/100 | First seen |
| SHA256 | b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d | Medium | Score 53/100 | First seen |
| Domain | zmailanalytics.com | High | Score 58/100 | First seen |
| Domain | emailanalytics.com.ua | High | Score 58/100 | First seen |
| Domain | zimbra-metadata.com | High | Score 58/100 | First seen |
| CVE | CVE-2025-66376 | High | Score 66/100 | First seen |
| Domain | analyticemailmeter.com | High | Score 76/100 | First seen |
| Domain | zimbrastat.com | High | Score 58/100 | First seen |
| Domain | mailnalysis.com | High | Score 58/100 | First seen |
| Domain | zimbrasoft.com.ua | High | Score 58/100 | First seen |
| SHA256 | 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf | Medium | Score 53/100 | First seen |
| SHA256 | 1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760 | Medium | Score 53/100 | First seen |
| Domain | synacorzimbra.nl | High | Score 79/100 | First seen |
IOC Relationship Graph
14 total IOCs
DomainSHA256CVE
scroll to zoom · drag to pan · click IOC to open