Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A group of Russian government-backed spies spent months studying Western mailboxes for a then-unknown flaw in the Zimbra webmail client.

Payload expires after the last 90 days of email, all corporate email addresses, passwords stored in the browser and codes stored for two-factor authentication. Opening a message is enough to start it.

The NSA, CISA and partner agencies published a joint advisory on the campaign Thursday, along with research by Palo Alto Networks’ Unit 42 and Proofpoint.

The advisory calls this technique a “view-based exploit that only requires the user to view the malicious email” on the vulnerable client. It says actors have been targeting Western governments and commercial organizations using Zimbra since at least July 2025.

error, CVE-2025-66376is a cross-site scripting vulnerability in Zimbra’s Classic UI. An HTML email that is created violates CSS @import manage to use JavaScript within an authenticated webmail session, so that the payload inherits the user’s access to the mailbox.

The two CVSS records disagree on whether viewing a message counts as user interaction: NVD scores 6.1 and says it does; MITER got 7.2 and says it doesn’t. Unit 42 calls it zero click. All three describe the same behavior: the message runs when you render, and nothing else should happen.

It affects Zimbra Collaboration 10.0 and earlier 10.0.18 and 10.1 before 10.1.13. Zimbra fixed it on November 6, 2025, and CISA added it to the Known Exploits catalog on March 18, 2026. Proofpoint, which tracks the actor as TA488, said the group exploited the bug as an unknown for at least five months in 2025, before that fix.

The patch closes the hole, not the account. The update does not revoke the credentials you have already taken.

Proofpoint said the messages came from adversary-controlled Proton Mail accounts and previously compromised addresses, using standard wires. Unit 42, which goes by the job as CL-STA-1114, said they are often dressed as a current affairs bulletin. The manipulation resides in the body of the HTML.

It hides the svg onload mark inside a display:none div, then splits the fake tag @import directives and HTML comments, the Proofpoint process calls for tag separation. Zimbra sanitizer does not recognize fragments as usable tags. Strips the @import respectively, and the letters left behind are shared used by the browser.

Proofpoint tracks the loading of JavaScript like ZimReaper. It steals the browser’s auto-filled CSRF token and password, pulls 2FA scratch codes and Zimbra version information via platform APIs, and outputs them over DNS queries to the actors’ infrastructure. It then brute forces the Global Address List, querying every two-letter combination until the entire list is returned, and sends 90 days of the victim’s mail to C2 as the TGZ archive.

Unit 42 listed at least nine C2 IP addresses and nine domains, each server living an average of 35.4 days. It named no organizations involved and did not give a number of victims. Its list of sectors and regions defines who is targeted. It does not say who was compromised. That list applies to government, defense, transport and finance organizations in NATO member countries, Ukraine, the Commonwealth of Independent States and Africa. Proofpoint puts US organizations on it as well: government, scientific and defense industrial establishments, including nuclear weapons installations.

The payload disables the app-specific password ZimbraWeb by using CreateAppSpecificPasswordRequestwhich can provide IMAP, POP3 or SMTP access without two-factor authentication. Proofpoint said TA488 went on to send other exploit emails from compromised email servers, and could not say whether app passwords or other stolen credentials were the culprit.

In the January issue analyzed by Seqrite, at the Ukrainian state hydrology center, the payload has also changed. zimbraPrefImapEnabled in the TRUTH. “Application-specific passwords survive password resets,” the researchers wrote.

Patch, then check the accounts

Zimbra 10.0 reached end-of-life on December 31, 2025, making it so 10.0.18 the destination is more urgent than the destination. The new 10.1 release is 10.1.20as of July 20th, fixing four additional XSS bugs in the Classic Web Client.

Upgrade to a 10.1 deployment to at least 10.1.13and move the 10.0 deployment to a supported 10.1 build. Then work accounts. Any mailbox that opened or previewed the same message in a compromised Classic UI session should be considered potentially vulnerable: reset the password, close active sessions, and regenerate 2FA scratch codes.

Messages that have arrived but not been opened should be pulled and their HTML checked for differences @import pattern, which is consistent with YARA’s published Proofpoint rule. The review does not check any of the below.

From Proofpoint’s and Seqrite’s guides:

• Update /opt/zimbra/log/audit.log for calls to CreateAppSpecificPassword and remove any fabricated evidence ZimbraWeb
• Find accounts with zimbraPrefImapEnabled set to TRUE that have no business need for IMAP
• Warning on SOAP calls to GetScratchCodesRequestwhich should be almost non-existent in normal use
• Filter DNS for published C2 domains and alert on random long subdomain view payload uses exclusion.

Is it still working?

How the campaign plays out depends on whose telemetry you read. Unit 42 said that threat actors continue to identify undocumented ZCS incidents using this feature, without saying that this batch is among them.

The advisory warns of ongoing work and assesses that this group will likely continue to pursue Zimbra and other Western email systems, even if this campaign ends as organizations join forces. Proofpoint said it “has not seen any TA488 activity since February 2026,” and linked the silence to the revelation of Seqrite and the actor destroying its infrastructure. Dealer telemetry doesn’t solve it.

Hacker News compared the two reference lists and found nine identical domains in both, which puts Unit 42’s CL-STA-1114 and Proofpoint’s TA488 in the same infrastructure. Proofpoint’s first sighting dates are from July 2025 to February 2026.

The advisory lists LAUNDRY BEAR, Void Blizzard, CL-STA-1114, and TA488 as common names for these players, while warning that the map may not be a one-to-one. Proofpoint said it could not tie TA488 to the Void Blizzard in its telemetry, and that US government partners have confirmed the agency. Seqrite said its January charge was caused by APT28 with moderate confidence, while the Dutch genius, who named LAUNDRY BEAR, treats it and APT28 as separate players.

For defenders, the design argument changes slightly. Patching stops the next generated email from running. It doesn’t undo what was left behind, which is why the account update is as important as the version number.