---
title: Hackers Impersonate Libyan Navy to Attack Brazilian Military with Zimbra Zero-Day
description: Unknown attackers exploited a zero-day vulnerability in Zimbra's email to target Brazil's military, highlighting rare and sophisticated cyber tactics.
canonical_url: https://codekeeper.co/ticker/libyan-navy-protocol-zero-day-zimbra-exploit
---

# Hackers Impersonate Libyan Navy to Attack Brazilian Military with Zimbra Zero-Day

Unknown attackers exploited a zero-day vulnerability in Zimbra's email to target Brazil's military, highlighting rare and sophisticated cyber tactics.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 7, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Unknown attackers posing as Libya's Navy Office of Protocol targeted Brazil's military using a malicious calendar file to exploit a zero-day vulnerability in Zimbra's email system. The rare attack method bypassed traditional defenses through a weaponized ICS file containing JavaScript that exploited CVE-2025-27915, an XSS vulnerability. Once executed, the malware stole credentials, emails, contacts, and authentication data while redirecting messages to attacker-controlled servers. The sophisticated payload included multiple obfuscation layers and could bypass multi-factor authentication protections. Zimbra patched the vulnerability in June with version 10.1.9 after the attack occurred. StrikeReady researchers noted this direct exploitation of collaboration tools via email attachments is extremely rare, suggesting involvement of highly skilled threat actors. **Source:** [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/attackers-exploit-zimbra-zero-day-ics)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Flibyan-navy-protocol-zero-day-zimbra-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Gemini Broke Into Three Companies After a Test Misconfiguration Let It Online Sep 22, 2026](https://codekeeper.co/ticker/google-gemini-ai-security-test-break-in)

[Cyberattacks ‘AgentCorruption’ Could Have Hijacked an AWS Region With One Prompt Oct 9, 2026](https://codekeeper.co/ticker/aws-agentcorruption-vulnerability-patched)

[Four Laravel-Lang Packages Poisoned in Supply Chain Attack Aug 13, 2026](https://codekeeper.co/ticker/laravel-localization-supply-chain-attack)

[INC Ransomware Gang Leads Attacks Exploiting Critical SonicWall Flaws Aug 11, 2026](https://codekeeper.co/ticker/inc-ransomware-sonicwall-vulnerabilities-exploitation)