Threats tagged 'needymantis'

CVE-2026-73570 is an unauthenticated OS command injection vulnerability in the SNMP notification path of Zimbra Collaboration Suite mail servers. It was actively exploited between July and August 2026. Attackers used this flaw to deploy JSP webshells and reverse shells without authentication, escalate privileges via PAM configuration abuse, and maintain persistence through systemd services. Post-exploitation activities included lateral movement across clusters using Zimbra SSH keys, theft of authentication secrets and mailbox data, and attempts to exfiltrate data using cloud storage tools. Multiple organizations across various regions and industries were targeted through automated and manual attacks on internet-facing Zimbra mail servers.

NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.