TA488 Used Zimbra XSS Flaw to Steal Emails and Maintain Access
Summary
Proofpoint details how Russia-aligned TA488 exploited CVE-2025-66376 in Zimbra webmail to steal credentials and emails from government and defense targets, establish persistent access, and exfiltrate data.
Key points
- TA488 exploited Zimbra vulnerability CVE-2025-66376 from at least July 2025 until it was patched.
- The half-click exploit ran when a victim opened or previewed an email in a vulnerable Zimbra webmail client; no link or attachment interaction was required.
- The ZimReaper malware stole session data, passwords, two-factor authentication codes, and mailbox details, then exfiltrated data through DNS and HTTP.
- It created a “ZimbraWeb” app-specific password to enable persistent mail-server access without two-factor authentication.
- Targets included Ukrainian entities and government, science, and defense organizations in the United States.
- Proofpoint reported no observed TA488 activity since February 2026, following public disclosure and the takedown of the group’s infrastructure.
- Zimbra users who may have been targeted are advised to review audit.log for CreateAppSpecificPassword calls and remove suspicious app-specific passwords.
Article Details
- Attack Vectors
- TA488 embedded a stored cross-site scripting exploit for CVE-2025-66376 in HTML email bodies. Opening or previewing the message in a vulnerable Zimbra webmail client triggered JavaScript without a link click or attachment.
- The exploit used tag-splitting with fake CSS @import directives and HTML comments to evade Zimbra's HTML sanitizer and reconstruct an executable SVG onload handler.
- After execution, ZimReaper accessed authenticated webmail-session data, collected CSRF tokens, saved passwords and two-factor authentication codes, enumerated the Global Address List, and exfiltrated data through DNS queries and HTTP POST requests.
- ZimReaper created a ZimbraWeb app-specific password for persistent access and subsequent email theft or phishing. TA488 also used compromised sender accounts to send exploit-laden messages to additional targets.
- Defensive Notes
- For potentially targeted Zimbra systems, review /opt/zimbra/log/audit.log for CreateAppSpecificPassword calls and remediate any app-specific password named ZimbraWeb or similar.
- CVE-2025-66376 was patched; the article reports that exploitation continued until the issue was patched.
- The article lists ET rules 2071243–2071249 for ZimReaper C2 activity, exfiltration, mailbox archive export, and Global Address List enumeration, and rule 2865592 for the Zimbra sanitization bypass.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | analyticemailmeter[.]com | TA488 campaign domain listed as ZimReaper infrastructure. |
| DOMAIN | emailanalytics[.]com[.]ua | TA488 campaign domain listed as ZimReaper infrastructure. |
| DOMAIN | istc-cloud[.]com | TA488 campaign domain listed as ZimReaper infrastructure. |
| DOMAIN | mailnalysis[.]com | TA488 campaign domain listed as ZimReaper infrastructure. |
| DOMAIN | synacorzimbra[.]nl | TA488 campaign domain listed as ZimReaper infrastructure. |
| DOMAIN | zimbra-metadata[.]com | TA488 campaign domain listed as ZimReaper infrastructure. |
| DOMAIN | zimbrasoft[.]com[.]ua | TA488 campaign domain listed as ZimReaper infrastructure. |
| DOMAIN | zimbrastat[.]com | TA488 campaign domain listed as ZimReaper infrastructure. |
| DOMAIN | zmailanalytics[.]com | TA488 ZimReaper command-and-control domain. |
c[.]laurent[.]ejfa@proton[.]me | Actor-controlled sender address used in the campaigns. | |
j[.]moreau[.]epsc@proton[.]me | Actor-controlled sender address listed among campaign indicators. | |
liberty[.]insights@proton[.]me | Actor-controlled sender address listed among campaign indicators. | |
| SHA256 | 1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760 | SHA-256 hash listed for an exploit email. |
| SHA256 | 60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874 | SHA-256 hash listed for an exploit email. |
| SHA256 | 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf | SHA-256 hash of an exploit email. |
| SHA256 | b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d | SHA-256 hash listed for an exploit email. |
MITRE ATT&CK
T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolThe malware exfiltrated credentials, installation details, and other collected data through DNS queries to adversary C2.T1056.003 · Web Portal CaptureThe malware collected the logged-in user's auto-complete password and two-factor authentication codes.T1059.007 · JavaScriptZimReaper executed JavaScript in the victim's authenticated Zimbra browser session.T1098.001 · Additional Cloud CredentialsZimReaper created a ZimbraWeb app-specific password for persistent access to the mailserver.T1114.002 · Remote Email CollectionZimReaper used Zimbra export functionality to collect and exfiltrate accessible email messages.T1189 · Drive-by CompromiseOpening or previewing a crafted email in the vulnerable Zimbra webmail client triggered the embedded exploit.T1566.002 · Spearphishing LinkTA488 sent generic lure emails containing the embedded exploit to targeted users.
CVE
People
Threat Actors
Laundry BearThe article identifies Laundry Bear as an alternative name associated with TA488.TA488Threat actor Proofpoint reports exploiting Zimbra with ZimReaper to steal email and credentials; the article says TA488 is also known as Void Blizzard and Laundry Bear.Void BlizzardThe article identifies Void Blizzard as an alternative name associated with TA488.
Malware
Products
Zimbra Collaboration SuiteSince at least July 2025, TA488 (previously UNK_PitStop) has used an exploit in Zimbra Collaboration Suite mailservers to target Ukrainian entities (as noted by Seqrite), as well as nuclear installations and the defenseZimbra WebmailThe XSS exploit is embedded directly in the HTML body of the message and fires as soon as the victim opens or previews it in the vulnerable Zimbra webmail client.
Countries
Industries
DefenseThe campaigns targeted Ukrainian government entities, as well as government, high science, and defense industrial base targets in the United States.Diplomatica consistent mix of targeting Ukrainian government entities alongside US and European energy, science, diplomatic entities, and defense contractors.EducationTA488 sent messages exploiting CVE-2025-66376 from both adversary-controlled Proton Mail accounts and previously compromised addresses, to target entities in the government and education sectors.EnergyTA488 displays a consistent mix of targeting Ukrainian government entities alongside US and European energy, science, diplomatic entities, and defense contractors.GovernmentThis is part 1 of a 2-part blog series Proofpoint is publishing about Russian espionage actors using half-click exploits to target government webmail servers.ScienceThe campaigns targeted Ukrainian government entities, as well as government, high science, and defense industrial base targets in the United States.