Russian-Linked Espionage Group Used Zimbra Zero-Day to Steal Mail and 2FA Codes
Summary
A campaign tracked as TA488 and CL-STA-1114 exploited CVE-2025-66376 in Zimbra Classic UI from at least July 2025, using crafted emails to steal mail, passwords and 2FA recovery codes. Zimbra patched the flaw in November 2025.
Key points
- CVE-2025-66376 is a stored XSS flaw in Zimbra Classic UI; crafted HTML abused CSS @import handling to execute JavaScript when a message rendered in an authenticated session.
- The ZimReaper payload stole CSRF tokens, browser-saved passwords, 2FA scratch codes and mailbox data, and exfiltrated information over DNS.
- The payload also created an app-specific password named ZimbraWeb, which could provide mail access without two-factor authentication.
- The campaign targeted government, defense, transportation and financial organizations across several regions, but the reporting names no affected organizations or victim count.
- Zimbra fixed the flaw on November 6, 2025; affected versions are 10.0 before 10.0.18 and 10.1 before 10.1.13. CISA added the CVE to its Known Exploited Vulnerabilities catalog in March 2026.
- Guidance includes upgrading, resetting passwords, invalidating sessions, regenerating 2FA scratch codes and reviewing accounts for app-specific passwords and suspicious API activity.
- Current activity assessments differ: Unit 42 reported continued targeting of unpatched systems, while Proofpoint said it had not observed TA488 activity since February 2026. Actor-name associations also remain uncertain.
Article Details
- Attack Vectors
- A crafted HTML email exploits stored XSS in Zimbra Classic UI. Rendering or previewing the message in a vulnerable session triggers the payload without further user interaction.
- The email uses hidden SVG markup, fragmented with fake CSS @import directives and HTML comments, which the article says bypasses Zimbra's sanitizer and executes JavaScript.
- ZimReaper uses Zimbra APIs to retrieve mailbox data, the Global Address List, browser-autofilled passwords, CSRF tokens, and 2FA scratch codes.
- The payload creates an app-specific password named ZimbraWeb and uses DNS queries to exfiltrate stolen data; it sends 90 days of email to C2 as a TGZ archive.
- Defensive Notes
- Upgrade Zimbra 10.0 deployments to a supported 10.1 release and at least version 10.1.13; upgrade 10.1 deployments to at least 10.1.13. The article reports that Zimbra fixed CVE-2025-66376 on November 6, 2025.
- Treat mailboxes that opened or previewed a matching message in a vulnerable Classic UI session as potentially compromised: reset passwords, invalidate active sessions, and regenerate 2FA scratch codes.
- Review /opt/zimbra/log/audit.log for CreateAppSpecificPassword calls and remove credentials named ZimbraWeb. Investigate unnecessary accounts with zimbraPrefImapEnabled set to TRUE and alert on GetScratchCodesRequest calls.
- Check unopened messages for the fragmented @import pattern described in the article. Filter DNS for published C2 domains and alert on long random subdomain lookups; the article does not provide the domain values.
MITRE ATT&CK
T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolThe payload exfiltrates stolen information through DNS queries to actor infrastructure.T1059.007 · JavaScriptThe ZimReaper payload is JavaScript executed in the authenticated Zimbra webmail session.T1087.003 · Email AccountThe payload enumerates the Global Address List by querying two-character combinations.T1114.002 · Remote Email CollectionThe payload retrieves the victim's recent email from the Zimbra mailbox and sends it to C2.T1203 · Exploitation for Client ExecutionThe crafted email exploits stored XSS in Zimbra Classic UI, causing code to execute when the message renders.T1555.003 · Credentials from Web BrowsersThe payload steals the password autofilled in the victim's browser.
CVE
Threat Actors
APT28Seqrite attributed a January case involving a Ukrainian state hydrology agency to APT28 with medium confidence. The article notes that Dutch intelligence treats APT28 and LAUNDRY BEAR as separate actors.CL-STA-1114Unit 42 uses this name for the activity involving Zimbra exploitation and reports that its C2 infrastructure overlapped with the domains in Proofpoint's TA488 indicator list. The advisory cautions that actor-name mappings may not be one-to-one.Laundry BearThe advisory lists LAUNDRY BEAR among names used in the community for the actors, while warning that mappings may not be one-to-one. Dutch intelligence treats LAUNDRY BEAR and APT28 as separate actors.TA488Proofpoint tracks the group as exploiting CVE-2025-66376 to target organizations with malicious emails and steal mailbox data and credentials. The article reports that Proofpoint observed no TA488 activity after February 2026.
Malware
Vendors
Palo Alto NetworksThe NSA, CISA and partner agencies published a joint advisory on the campaign Thursday, alongside research from Palo Alto Networks’ Unit 42 and Proofpoint.ProofpointThe NSA, CISA and partner agencies published a joint advisory on the campaign Thursday, alongside research from Palo Alto Networks’ Unit 42 and Proofpoint.SeqriteIn the January case Seqrite analyzed, at a Ukrainian state hydrology agency, the payload also flipped zimbraPrefImapEnabled to TRUE.ZimbraA Russian state-backed espionage group used CVE-2025-66376 in Zimbra’s Classic UI to read Western mailboxes for months, stealing recent email, directories, saved passwords, and 2FA recovery codes.
Products
Countries
UkraineThat list runs across government, defense, transportation and financial organizations in NATO member states, Ukraine, the Commonwealth of Independent States and Africa.United StatesThe campaign, tracked as TA488 and CL-STA-1114, used crafted HTML emails with the ZimReaper payload and targeted government, defense, transportation, financial, and US organizations before Zimbra’s November 2025 patch.
Industries
DefenseThe campaign, tracked as TA488 and CL-STA-1114, used crafted HTML emails with the ZimReaper payload and targeted government, defense, transportation, financial, and US organizations before Zimbra’s November 2025 patch.GovernmentThe campaign, tracked as TA488 and CL-STA-1114, used crafted HTML emails with the ZimReaper payload and targeted government, defense, transportation, financial, and US organizations before Zimbra’s November 2025 patch.TransportationThe campaign, tracked as TA488 and CL-STA-1114, used crafted HTML emails with the ZimReaper payload and targeted government, defense, transportation, financial, and US organizations before Zimbra’s November 2025 patch.