A Russian state-backed espionage group spent months reading Western mailboxes through an unknown flaw in Zimbra’s webmail client.
The payload goes after the last 90 days of emails, the organization’s entire email directory, passwords saved in the browser, and codes placed for two-factor recovery. To start it, it was enough to open the message.
The NSA, CISA and partner agencies published a joint advisory on the campaign on Thursday, with research from Palo Alto Networks’ Unit 42 and Proofpoint.
The advisory calls this technique “a visual-based exploit that only requires the user to view the malicious email in a vulnerable client”. It says actors have been targeting and compromising Western government and commercial organizations through Zimbra since at least July 2025.
Shortcoming, CVE-2025-66376Zimbra’s Classic UI has a stored cross-site scripting vulnerability. A crafted HTML email abuses CSS @import Handling to execute JavaScript inside an authenticated webmail session, so the payload gains access to the user’s mailbox.
The two CVSS records disagree on whether viewing the message counts as user interaction: NVD gives it a score of 6.1 and says it does; MITER has given it a score of 7.2 and said that it is not. Unit 42 calls it zero-click. All three describe the same behavior: the message plays when it’s presented, and nothing else happens.
This affects Zimbra Collaboration 10.0 first 10.0.18 and before 10.1 10.1.13. Zimbra fixed it on November 6, 2025, and CISA added it to the list of known exploited vulnerabilities on March 18, 2026. Proofpoint, which tracks the actor as TA488, said the group exploited the bug as an unknown vulnerability for at least five months during 2025, before the fix was known to be in place.
The patch closes the hole, doesn’t eat it. An update does not revoke credentials already taken by the payload.
Proofpoint said the messages were sent from rival-controlled Proton Mail accounts and previously compromised addresses using simple lures. Unit 42, which tracks activity as CL-STA-1114, said they were often dressed up as a digest of current news. The exploit sits in the HTML body.
This one hides svg onload tag inside a display:none div, then strips off the tag with the fake @import Instructions and HTML comments, a technique Proofpoint calls tag-splitting. Zimbra’s sanitizer does not recognize fragments as executable markup. it snatches away @import sequence, and the characters left behind join in <svg onload=eval(atob(...))>Which runs the browser.
Proofpoint tracks JavaScript payloads as ZimReaper. It steals CSRF tokens and the browser’s autofilled passwords, pulls 2FA scratch codes and Zimbra version details through the platform’s own API, and sends them over DNS queries to the actor infrastructure. It then brute-forces the global address list, queries each two-letter combination until the entire list is returned, and posts 90 days of the victim’s mail to C2 as a TGZ archive.
Unit 42 counted at least nine C2 IP addresses and nine domains, with each server lasting an average of 35.4 days. In this, the name of any affected organization was not mentioned nor was any count of victims given. Its list of sectors and regions shows which were targeted. It does not say who was compromised. This list concerns government, defence, transport and financial organizations in NATO member states, Ukraine, the Commonwealth of Independent States and Africa. Proofpoint also covers US organizations: government, scientific, and defense industrial base entities, including nuclear establishments.
The payload creates an app-specific password named ZimbraWeb Through CreateAppSpecificPasswordRequestWhich can provide IMAP, POP3 or SMTP access without two-factor authentication. Proofpoint said TA488 sent further emails from the compromised mailserver, and could not say whether the app password or other stolen credentials were what brought it back.
In the case analyzed by SECRET in January at the Ukrainian State Hydrology Agency, the payload was also flipped. zimbraPrefImapEnabled true to. “App-specific passwords survive password resets,” the researchers wrote.
Patch, then check accounts
Zimbra 10.0 ends of life on December 31, 2025, which makes 10.0.18 An emergency destination rather than a destination. The latest release is 10.1 10.1.20On July 20, that fixes four more stored XSS flaws in the Classic Web client.
10.1 Upgrade deployment minimally 10.1.13And move the 10.0 deployment to a supported 10.1 build. Then do the accounting work. Any mailbox that opened or previewed a matching message in a vulnerable Classic UI session should be considered potentially compromised: reset the password, invalidate the active session, and regenerate the 2FA scratch code.
Messages that arrived but were never opened should be extracted and examined for fragmented HTML. @import Pattern, which matches Proofpoint’s published YARA rule. The update does not perform any of the checks below.
They come from guidance from Proofpoint and Secrete:
- Review
/opt/zimbra/log/audit.logfor callCreateAppSpecificPasswordand remove any credentials namedZimbraWeb - Find accounts with
zimbraPrefImapEnabledSet to TRUE for those with no business need for IMAP - Alert on SOAP call
GetScratchCodesRequestwhich should be close to absent in normal use - Filter DNS for published C2 domains and alert on long random subdomain lookups that the payload uses to exfiltrate
still running?
How alive the campaign is depends on whose telemetry you read. Unit 42 said threat actors continue to actively target unpatched ZCS instances using the flaw, without specifying whether this cluster is one of them.
The advisory warns about ongoing activity and assesses that the group will continue to do so after Zimbra and other Western email systems are shut down as organizations patch the campaign. Proofpoint said it “has not seen any activity from TA488 since February 2026,” and remained silent on Secrite’s disclosures and the actor’s destruction of its own infrastructure. No vendor’s telemetry addresses this.
Hacker News compared the two indicator lists and found the same nine domains in both, which puts Unit 42’s CL-STA-1114 and Proofpoint’s TA488 on the same infrastructure. Proofpoint’s first sighting dates run from July 2025 to February 2026.
The advisory lists Laundry Bear, Void Blizzard, CL-STA-1114, and TA488 as community-use names for these actors, while cautioning that the mapping may not be one-to-one. Proofpoint said it could not link TA488 to the Void Blizzard from its own telemetry, and US government partners confirmed the association. SECRET attributed its January case to APT28 with medium confidence, while Dutch intelligence, which named it LAUNDRY BEAR, considers it and APT28 as separate actors.
For defenders, the naming logic changes slightly. Patching prevents the next crafted email from running. It doesn’t cancel out what the previous one left, which is why account reviews matter as much as the version number.
