Zimbra GetScratchCodesRequest SOAP Call to Steal 2FA Recovery Codes

Ethan Andrews@eandrews

•updated Jul 23, 2026•3•0•9

Detects anomalous SOAP requests to 'GetScratchCodesRequest' within the 'zimbraSync' or 'zimbraAccount' namespaces in Zimbra logs. This activity is indicative of credential harvesting attempts, specifically the exfiltration of 2FA recovery scratch codes, often associated with the ZimReaper/Ulej payload used by threat actors.