Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra’s webmail client.

The payload goes after the last 90 days of email, the organization’s entire email directory, the password saved in the browser and the codes kept for two-factor recovery. Opening the message was enough to start it.

The NSA, CISA and partner agencies published a joint advisory on the campaign Thursday, alongside research from Palo Alto Networks’ Unit 42 and Proofpoint.

The advisory calls the technique “a view-based exploit that only requires a user to view a malicious email” in a vulnerable client. It says the actors have been targeting and compromising Western government and commercial organizations through Zimbra since at least July 2025.

The flaw, CVE-2025-66376, is a stored cross-site scripting vulnerability in Zimbra’s Classic UI. A crafted HTML email abuses CSS @import handling to execute JavaScript inside an authenticated webmail session, so the payload inherits the user’s access to the mailbox.

The two CVSS records disagree on whether viewing the message counts as user interaction: NVD scores it 6.1 and says it does; MITRE scores it 7.2 and says it does not. Unit 42 calls it zero-click. All three describe the same behavior: the message runs when it renders, and nothing else has to happen.

It affects Zimbra Collaboration 10.0 before 10.0.18 and 10.1 before 10.1.13. Zimbra fixed it on November 6, 2025, and CISA added it to the Known Exploited Vulnerabilities catalog on March 18, 2026. Proofpoint, which tracks the actor as TA488, said the group exploited the bug as an unknown vulnerability for at least five months during 2025, before that fix existed.

Proofpoint said the messages went out from adversary-controlled Proton Mail accounts and from previously compromised addresses, using generic lures. Unit 42, which tracks the activity as CL-STA-1114, said they were often dressed as a digest of current news. The exploit sits in the HTML body.

It hides an svg onload tag inside a display:none div, then breaks the tag apart with fake @import directives and HTML comments, a technique Proofpoint calls tag-splitting. Zimbra’s sanitizer does not recognize the fragments as executable markup. It strips the @import sequences, and the characters left behind join into , which the browser runs.

Proofpoint tracks the JavaScript payload as ZimReaper. It steals the CSRF token and the browser’s autofilled password, pulls 2FA scratch codes and Zimbra version details through the platform’s own APIs, and exfiltrates them over DNS queries to actor infrastructure. Then it brute-forces the Global Address List, querying every two-character combination until the whole list comes back, and posts 90 days of the victim’s mail to the C2 as a TGZ archive.

Unit 42 counted at least nine C2 IP addresses and nine domains, each server live for an average of 35.4 days. It named no affected organizations and gave no victim count. Its list of sectors and regions describes who was targeted. It does not say who was compromised. That list runs across government, defense, transportation and financial organizations in NATO member states, Ukraine, the Commonwealth of Independent States and Africa. Proofpoint puts US organizations on it too: government, scientific and defense industrial base entities, including nuclear installations.

The payload mints an app-specific password named ZimbraWeb through CreateAppSpecificPasswordRequest, which can grant IMAP, POP3 or SMTP access without two-factor authentication. Proofpoint said TA488 went on to send further exploit emails from compromised mailservers, and could not say whether the app passwords or other stolen credentials were what got it back in.

In the January case Seqrite analyzed, at a Ukrainian state hydrology agency, the payload also flipped zimbraPrefImapEnabled to TRUE. “App-specific passwords survive password resets,” the researchers wrote.

Patch, then check the accounts

Zimbra 10.0 reached end of life on December 31, 2025, which makes 10.0.18 an emergency floor rather than a destination. The newest 10.1 release is 10.1.20, out July 20, which fixes four more stored XSS flaws in the Classic Web Client.

Upgrade 10.1 deployments to at least 10.1.13, and move 10.0 deployments onto a supported 10.1 build. Then work the accounts. Any mailbox that opened or previewed a matching message in a vulnerable Classic UI session should be treated as potentially compromised: reset the password, invalidate active sessions, and regenerate 2FA scratch codes.

Messages that landed but were never opened should be pulled and their HTML checked for the fragmented @import pattern, which Proofpoint’s published YARA rule matches. The update does none of the checks below.

They come from Proofpoint’s and Seqrite’s guidance:

• Review /opt/zimbra/log/audit.log for calls to CreateAppSpecificPassword and remove any credential named ZimbraWeb
• Find accounts with zimbraPrefImapEnabled set to TRUE that have no business need for IMAP
• Alert on SOAP calls to GetScratchCodesRequest, which should be close to absent in normal use
• Filter DNS for the published C2 domains and alert on the long random subdomain lookups the payload uses to exfiltrate

Still running?

How live the campaign is depends on whose telemetry you read. Unit 42 said threat actors continue to actively target unpatched ZCS instances using the flaw, without saying whether this cluster is among them.

The advisory warns of ongoing activity and assesses that the group will very likely keep going after Zimbra and other Western email systems, even if this campaign winds down as organizations patch. Proofpoint said it “has not observed any activity from TA488 since February 2026,” and tied the silence to Seqrite’s disclosure and the actor tearing down its own infrastructure. Neither vendor’s telemetry settles it.

The Hacker News compared the two indicator lists and found the same nine domains in both, which puts Unit 42’s CL-STA-1114 and Proofpoint’s TA488 on the same infrastructure. Proofpoint’s first-seen dates run from July 2025 through February 2026.

The advisory lists LAUNDRY BEAR, Void Blizzard, CL-STA-1114, and TA488 as names in community use for these actors, while cautioning that the mapping may not be one-to-one. Proofpoint said it could not tie TA488 to Void Blizzard from its own telemetry, and that US government partners confirmed the association. Seqrite attributed its January case to APT28 with medium confidence, while Dutch intelligence, which named LAUNDRY BEAR, treats it and APT28 as separate actors.

For defenders, the naming argument changes little. Patching stops the next crafted email from running. It does not revoke what the last one left behind, which is why the account review matters as much as the version number.