---
title: IcedID and Zimbra Exploits Target Ukrainian Government Entities
description: CERT-UA recently released an advisory on IcedID and Zimbra exploits targeting Ukraine.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [IcedID and Zimbra Exploits Target Ukrainian Government Entities](https://blog.polyswarm.io/icedid-and-zimbra-exploits-target-ukrainian-government-entities)

 Written by [PolySwarm Tech Team](https://blog.polyswarm.io/author/polyswarm-tech-team) | Apr 22, 2022 5:38:37 PM

Background

CERT-UA recently released an [advisory](https://cert-gov-ua.translate.goog/article/39609?_x_tr_sl=uk&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp) on IcedID, a modular banking trojan being dropped via a social engineering campaign targeting Ukrainian government entities, and related Zimbra exploits.  
What is IcedID?

IcedID, also known as BokBot, is a modular banking trojan supporting a full-fledged stealer and next stage implants, such as ransomware and Cobalt Strike beacons. According to CERT-UA, a threat actor group dubbed UAC-0098 is engaging in social engineering campaigns delivering IcedID and leveraging Zimbra exploits. The threat actors are sending phishing emails containing a malicious Microsoft Excel document that uses macros to deploy IcedID. The file used in the phishing email is named *Мобілізаційний реєстр.xls* or *Mobilization Register.xls*.

 

**Figure 1** A screenshot showing elements of the malicious Microsoft Excel file. Credit [CERT-UA](https://cert-gov-ua.translate.goog/article/39609?_x_tr_sl=uk&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp)

CERT-UA also reported a [second](https://cert-gov-ua.translate.goog/article/39606?_x_tr_sl=uk&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp) set of intrusions perpetrated by another threat actor group, UAC-0097. In this campaign, the phishing emails included a number of image attachments with a Content-Location header pointing to a remote server. The server hosted a piece of JavaScript code that activated an exploit leveraging **CVE-2018-6882**, a Zimbra cross-site scripting vulnerability. In the final stage of the attack, the JavaScript is used to forward the victim’s emails to a threat actor controlled email address for espionage purposes.

IOCs

PolySwarm has multiple samples associated with IcedID.

[8f7e3471c1bb2b264d1b8f298e7b7648dac84ffd8fb2125f3b2566353128e127 ](https://polyswarm.network/scan/results/file/8f7e3471c1bb2b264d1b8f298e7b7648dac84ffd8fb2125f3b2566353128e127)

[65b208943d8cf82af902c39400bdd7a26fdbc94c23f9d4494cf0a2ca51233213](https://polyswarm.network/scan/results/file/65b208943d8cf82af902c39400bdd7a26fdbc94c23f9d4494cf0a2ca51233213) 

[de7bcc556dde40d347b003d891f36c2a733131593ce2b9382f0bd9ade123d54a](https://polyswarm.network/scan/results/file/de7bcc556dde40d347b003d891f36c2a733131593ce2b9382f0bd9ade123d54a) 

[ac1d19c5942946f9eee6bc748dee032b97eb3ec3e4bb64fead3e5ac101fb1bc8](https://polyswarm.network/scan/results/file/ac1d19c5942946f9eee6bc748dee032b97eb3ec3e4bb64fead3e5ac101fb1bc8) 

[84f016ece77ddd7d611ffc0cbb2ce24184aeee3a2fdbb9d44d0837bc533ba238](https://polyswarm.network/scan/results/file/84f016ece77ddd7d611ffc0cbb2ce24184aeee3a2fdbb9d44d0837bc533ba238)

You can use the following CLI command to search for all IcedID samples in our portal:

***$ polyswarm link list -f IcedID***

**Don’t have a PolySwarm account? Go** [**here**](https://polyswarm.network/) **to sign up for a free Community plan or to subscribe.**

Contact us at [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) | Check out our [blog](https://blog.polyswarm.io/) | [Subscribe](https://polyswarm.io/ransomwarereport/) to our reports

[View full post](https://blog.polyswarm.io/icedid-and-zimbra-exploits-target-ukrainian-government-entities)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "PolySwarm Tech Team"
  },
  "dateModified" : "2022-04-22T17:38:37.871Z",
  "datePublished" : "2022-04-22T17:38:37Z",
  "headline" : "IcedID and Zimbra Exploits Target Ukrainian Government Entities",
  "image" : {
    "@type" : "ImageObject",
    "height" : 3154,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/IcedID_Blog.jpg",
    "width" : 5532
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/icedid-and-zimbra-exploits-target-ukrainian-government-entities",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```