Russian Spies Steal Email, 2FA via Zimbra Zero-Day

Key Takeaways

• A Russian‑state‑backed espionage group exploited a previously unknown stored XSS flaw (CVE‑2025-66376) in Zimbra’s Classic UI to run malicious JavaScript simply by having a victim view a crafted email—no clicks or additional interaction required.
• The payload (“ZimReaper”) stole recent emails, the full address book, browser‑saved passwords, 2FA recovery codes, and created app‑specific passwords that bypassed two‑factor authentication, allowing continued IMAP/POP3/SMTP access even after password resets.
• The vulnerability affected Zimbra Collaboration 10.0 < 10.0.18 and 10.1 < 10.1.13; a patch was released on 6 Nov 2025 and added to CISA’s KEV catalog on 18 Mar 2026, but the update does not revoke credentials already exfiltrated.
• Attribution is messy: the activity is tracked as TA488 (Proofpoint), CL‑STA-1114 (Unit 42), and linked to names such as LAUNDRY BEAR, Void Blizzard, and possibly APT28, though vendors caution that the mapping may not be one‑to‑one.
• Defenders must patch vulnerable Zimbra versions, then treat any mailbox that previewed or opened a malicious message as potentially compromised—reset passwords, invalidate sessions, regenerate 2FA codes, and audit for rogue app‑specific passwords, IMAP enablement, and suspicious DNS/API calls.
• Although public telemetry shows a lull in activity after February 2026, advisories warn that the group is likely to continue targeting unpatched Zimbra and other Western email systems until organizations fully remediate.

Overview of the Zimbra Exploit
In mid‑2025 a Russian state‑supported espionage group began using a zero‑click technique against Zimbra webmail. By simply viewing a malicious HTML email in the vulnerable Classic UI, victims unknowingly triggered JavaScript that operated with the same privileges as their authenticated session. The exploit required no clicks, downloads, or macro enabling—only the act of rendering the message. This allowed the attackers to harvest a wide range of data from compromised mailboxes and to establish persistent access mechanisms that survived password changes. The campaign primarily hit Western government, defense, financial, transportation, and scientific organizations across NATO member states, Ukraine, the Commonwealth of Independent States, Africa, and the United States.

Technical Details of CVE‑2025-66376
The flaw, catalogued as CVE‑2025-66376, is a stored cross‑site scripting vulnerability in Zimbra’s Classic Web Client. A specially crafted HTML email abuses the CSS @import rule handling: the payload hides an svg onload tag inside a display:none div, then fragments the tag with fake @import directives and HTML comments—a method Proofpoint dubs “tag‑splitting.” Zimbra’s sanitizer strips the @import sequences, leaving behind characters that recombine into executable markup when the browser renders the message. Because the script runs in the context of an authenticated webmail session, it inherits the user’s full mailbox access. Discrepancies exist between NVD (CVSS 6.1, user interaction required) and MITRE (CVSS 7.2, no user interaction), but Unit 42 and Proofpoint both classify the exploit as zero‑click, noting that mere preview or opening suffices.

Payload Functionality and Data Exfiltration
Proofpoint tracks the JavaScript payload as ZimReaper. Upon execution, it steals the CSRF token and any browser‑autofilled password, queries Zimbra’s internal APIs for two‑factor authentication scratch codes and version information, and exfiltrates the collected data over DNS queries to actor‑controlled infrastructure. The script then brute‑forces the Global Address List by querying every two‑character combination until the full list is returned, and finally packages the last 90 days of the victim’s email into a TGZ archive for upload to the command‑and‑control (C2) server. In addition, ZimReaper creates an app‑specific credential named ZimbraWeb via the CreateAppSpecificPasswordRequest API, granting IMAP, POP3, or SMTP access without needing the user’s password or 2FA—a credential that persists through password resets.

Attribution and Actor Naming
The activity is tracked under multiple aliases: Proofpoint designates the group TA488, while Unit 42 labels the campaign CL‑STA-1114. Government and industry reports also reference the names LAUNDRY BEAR and Void Blizzard, and Seqrite’s January 2026 case tied the activity to APT28 with medium confidence. Dutch intelligence treats LAUNDRY BEAR and APT28 as distinct, and U.S. government partners have confirmed a link between TA488 and Void Blizzard, though Proofpoint’s own telemetry could not establish that connection. The vendors caution that the mapping of these monikers to a single threat actor may not be one‑to‑one, but the overlapping infrastructure (identical C2 domains and IP addresses) strongly suggests a shared operation.

Timeline and Patch Information
The vulnerability impacts Zimbra Collaboration versions 10.0 prior to 10.0.18 and 10.1 prior to 10.1.13. Zimbra issued a fix on 6 November 2025, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 18 March 2026. Proofpoint notes that TA488 exploited the bug as an unknown zero‑day for at least five months during 2025 before the patch existed. Importantly, applying the update closes the code‑execution path but does not revoke any credentials, app‑specific passwords, or session tokens already stolen; consequently, post‑patch account hygiene is essential.

Impact on Organizations and Sectors Targeted
Unit 42’s targeting list spans government, defense, transportation, and financial sectors in NATO member states, Ukraine, the Commonwealth of Independent States, and Africa, with Proofpoint adding U.S. government, scientific, and defense‑industrial‑base entities—including nuclear installations—to the scope. While the vendors did not disclose specific victim counts or name compromised organizations, the breadth of sectors indicates a strategic aim to harvest sensitive diplomatic, military, and economic intelligence. The ability to read recent correspondence, exfiltrate address books, and retain persistent mailbox access amplifies the potential damage beyond a single breach.

Post‑Exploitation Credential Abuse
By minting the ZimbraWeb app‑specific password, attackers gain a standalone authentication token that can be used with IMAP, POP3, or SMTP clients, effectively bypassing both the primary password and any two‑factor mechanism. Proofpoint observed that TA488 later used compromised mailservers to launch additional exploit emails, suggesting a feedback loop where stolen credentials facilitated further intrusion. Because such app passwords survive password resets, simply changing the user’s login credential does not evict the attacker; the token must be explicitly revoked or the associated application disabled.

Defensive Recommendations and Account Hygiene
Administrators should first upgrade vulnerable Zimbra installations: move 10.0 deployments to a supported 10.1 build (at least 10.1.13) and ensure 10.1 instances run 10.1.20 or later, which also addresses four additional stored XSS flaws. After patching, treat any mailbox that previewed or opened a suspicious message in a vulnerable Classic UI session as potentially compromised. Recommended remediation steps include:

• Resetting the user’s password and invalidating all active sessions.
• Regenerating 2FA scratch codes.
• Auditing /opt/zimbra/log/audit.log for CreateAppSpecificPassword calls and removing any credential named ZimbraWeb.
• Checking for accounts where zimbraPrefImapEnabled is set to TRUE without a legitimate business need and disabling IMAP where appropriate.
• Monitoring for anomalous GetScratchCodesRequest SOAP calls.
• Deploying DNS filters for the published C2 domains and alerting on the long random sub‑domain lookups used for exfiltration.
• Applying Proofpoint’s YARA rule to scan stored or quarantined emails for the fragmented @import pattern.

These actions address both the immediate code‑execution vector and the lingering credential risks.

Current Activity and Ongoing Threat
Telemetry diverges on whether the campaign remains active. Unit 42 reports that threat actors continue to target unpatched Zimbra instances using the flaw, though it does not confirm whether the observed cluster is part of this group. Proofpoint states it has not observed TA488 activity since February 2026, attributing the lull to Seqrite’s public disclosure and the actors’ dismantling of their infrastructure. The Hacker News corroborated overlap between Unit 42’s and Proofpoint’s indicator lists, showing the same nine C2 domains and IP addresses across both datasets. Despite the current quiet, the joint NSA/CISA advisory warns that the group is very likely to persist in targeting Zimbra and other Western email systems until organizations achieve full patch coverage and rigorous account cleanup.

Conclusion and Strategic Implications
The Zimbra zero‑click exploit exemplifies how a relatively modest web‑client vulnerability can be leveraged for extensive espionage when combined with stealthy data‑gathering techniques and persistent credential abuse. The incident underscores the necessity of treating email client patches as urgent, but also of implementing comprehensive post‑compromise procedures—password rotation, session invalidation, app‑specific password audits, and vigilant monitoring for anomalous API and DNS behavior. For defenders, the lesson is clear: patching stops the next malicious email from executing, but without diligent account hygiene, the foothold established by the initial intrusion can endure long after the vulnerability is remedied. Prioritizing both layers—preventive updates and responsive credential remediation—is essential to mitigate the lasting impact of campaigns like the one attributed to TA488/CL‑STA-1114.