Ransomware gang exploits unpatched mail server to breach systems.

SmarterTools says a ransomware group known as Warlock broke into its network by exploiting an unpatched SmarterMail instance running on a virtual machine. The attackers moved laterally through the data center and compromised a dozen Windows servers before the company shut down affected systems and removed Active Directory services. The intrusion likely relied on CVE‑2026‑24423, a remote code execution flaw patched in mid‑January, and the company believes some customers were hit through the same vulnerability. SmarterTools urged users to update to the latest SmarterMail build, noting that even minor security updates can prevent attacks that strain server resources.

Read more:

https://www.securityweek.com/smartertools-hit-by-ransomware-via-vulnerability-in-its-own-product/