Seqrite Details Operation GhostMail Zimbra XSS Campaign Targeting Ukrainian Agency
Summary
Seqrite Labs reports that Operation GhostMail used Zimbra CVE-2025-66376 to steal account data and 90 days of mail from a Ukrainian government agency. It assesses APT28 attribution with medium confidence.
Key points
- Seqrite says the Ukrainian State Hydrology Agency received an internship-themed phishing email on January 22, 2026; the malicious JavaScript was embedded in the HTML body, with no attachment or external link.
- The attack required the recipient to open the email in an authenticated Zimbra Classic web session and exploited CVE-2025-66376, a stored XSS flaw involving inadequate sanitization of crafted HTML/CSS constructs.
- A Base64- and XOR-encoded loader injected a browser-resident stealer that used the victim’s session and Zimbra SOAP API to collect credentials, tokens, backup 2FA codes, account details, and server configuration.
- The payload reportedly created an app-specific password named “ZimbraWeb,” enabled IMAP, and collected up to 90 days of mailbox contents.
- Seqrite describes data exfiltration over Base32-encoded DNS queries and HTTPS POST requests.
- Seqrite assesses APT28 attribution with medium confidence, citing code and technique overlaps with SpyPress.ZIMBRA and targeting patterns; it says the findings were reported to CERT-UA.
- The article recommends upgrading to a patched Zimbra release, auditing and revoking suspicious app-specific passwords, and monitoring SOAP activity, IMAP changes, and DNS traffic.
Article Details
- Attack Vectors
- A Ukrainian-language internship inquiry delivered as a single HTML email contained obfuscated JavaScript in a hidden element, with no attachment or external link.
- When opened in the vulnerable Zimbra Classic web UI during an authenticated session, the email exploited stored XSS CVE-2025-66376 to execute JavaScript in the browser.
- The loader decoded a Base64-and-XOR payload and injected a browser-resident stealer into the top-level document, where it could use the victim's session context and SOAP API access.
- The stealer collected credentials, session data, recovery codes, account and device information, and up to 90 days of mailbox content; it also created an app-specific password and enabled IMAP.
- Collected data was sent to the reported C2 over HTTPS POST and DNS using Base32-encoded chunks.
- Defensive Notes
- Patch Zimbra Collaboration to a supported release; the article says CVE-2025-66376 was patched in ZCS 10.0.18 and 10.1.13.
- Audit for unexpected app-specific passwords named ZimbraWeb and revoke suspicious credentials; review unexpected changes enabling IMAP.
- Monitor Zimbra audit logs for unusual access to /home/~/?fmt=tgz and monitor SOAP activity, especially GetScratchCodesRequest and CreateAppSpecificPasswordRequest.
- Apply DNS filtering for the reported C2 indicators and consider alerting on the described d-[a-z0-9]{12}.i.* DNS pattern.
- Review whether IMAP and POP3 are needed for user accounts, and remind staff that HTML email bodies can carry executable content even without attachments or links.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | zimbrasoft[.]com[.]ua | Reported hardcoded C2 domain used for HTTPS and DNS data exfiltration. |
| HOSTNAME | js-26tik3egye4[.]i[.]zimbrasoft[.]com[.]ua | Reported generated hostname associated with the campaign's C2 infrastructure. |
| HOSTNAME | js-l1wt597cimk[.]i[.]zimbrasoft[.]com[.]ua | Reported generated hostname associated with the campaign's C2 infrastructure. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loader used Base64 and XOR encoding, and the payload used obfuscated @import-related constructs to bypass sanitization.T1041 · Exfiltration Over C2 ChannelThe stealer uploaded collected data to the C2 using HTTPS POST requests to /v/d and /v/p.T1059.007 · JavaScriptThe browser-resident JavaScript loader and stealer executed in the victim's Zimbra webmail session.T1071.004 · DNSThe stealer sent Base32-encoded data chunks through constructed DNS hostnames under the reported C2 domain.T1082 · System Information DiscoveryThe payload called GetInfoRequest to retrieve server configuration and fingerprint the environment.T1087.003 · Email AccountThe stealer gathered configured email identities and aliases using GetIdentitiesRequest and page data.T1098.001 · Additional Cloud CredentialsThe stealer used CreateAppSpecificPasswordRequest to create a persistent app-specific password named ZimbraWeb.T1111 · Multi-Factor Authentication InterceptionThe stealer used GetScratchCodesRequest to collect the account's backup 2FA recovery codes.T1114.002 · Remote Email CollectionThe stealer downloaded and exfiltrated daily email archives covering up to 90 days.T1120 · Peripheral Device DiscoveryThe payload used GetDeviceStatusRequest to enumerate ActiveSync-connected mobile devices.T1185 · Browser Session HijackingThe payload escaped the webmail iframe to access the top-level document and the victim's session context.T1203 · Exploitation for Client ExecutionThe article reports exploitation of stored XSS CVE-2025-66376 when a crafted email was viewed in Zimbra Classic.T1555.003 · Credentials from Web BrowsersThe payload injected hidden username and password fields and read credentials autofilled by the browser password manager.T1583.001 · DomainsThe article reports that the campaign's C2 domain was registered shortly before the phishing email was sent.T1586.002 · Email AccountsThe phishing email came from a National Academy of Internal Affairs student mailbox that the article assesses was likely compromised.
CVE
Threat Actors
APT28Seqrite assesses with medium confidence that Operation GhostMail aligns with APT28 tradecraft, based on technical overlaps and targeting; attribution is not definitive.Cozy BearThe article identifies Cozy Bear as an alternate name for APT29 and discusses its prior Zimbra exploitation.Fancy BearThe article identifies Fancy Bear as an alternate name for APT28 and discusses the group in connection with the medium-confidence attribution of Operation GhostMail.ICE RELICThe article says APT29 previously exploited Zimbra against Eastern European targets, while distinguishing that activity from Operation GhostMail's email-based XSS attack.TA473The article identifies TA473 as an alternate name for Winter Vivern and discusses its prior use of Zimbra XSS and JavaScript credential stealers.Winter VivernThe article says Winter Vivern previously exploited Zimbra against Eastern European targets.