Such a development comes after the vulnerability was discovered by Proofpoint to be leveraged in intrusions beginning September 28, following the release of its proof-of-concept exploit code and technical information by Project Discovery. Attacks involved the impersonation of Gmail to deliver base64 string-containing emails that would be executed by Zimbra servers, which have also been used for second-stage payload hosting, according to Proofpoint, which did not attribute the intrusions to a specific threat actor.

Source: SC Magazine