Russian Group Spent Six Months Reading Western Email via a 0-day in Zimbra

A state-sponsored Russian cyber-espionage group spent months accessing the mailboxes of Western organizations by exploiting a then-unknown vulnerability in Zimbra's webmail client. According to a joint advisory from the NSA, CISA and partner agencies, as well as research by Unit 42 (Palo Alto Networks) and Proofpoint, the attacks against government and commercial entities have been running since at least July 2025.

Opening the message is enough

The CVE-2025-66376 vulnerability is a stored cross-site scripting (stored XSS) flaw in the classic interface of Zimbra Collaboration. A specially crafted HTML email abuses the handling of the @import CSS directive to execute JavaScript right inside an authenticated webmail session. The payload thereby inherits all of the user's privileges. The assessments differ on the details: the NVD assigned a score of 6.1 and treats viewing the message as interaction, MITRE gives 7.2 and does not, and Unit 42 calls the attack zero-click. The gist is the same: the code fires when the message is rendered, and nothing else is required.

To bypass the built-in sanitizer, a malicious svg onload tag is hidden inside an invisible block and broken into fragments by fake @import directives and HTML comments — a technique Proofpoint calls “tag splitting.” The filter fails to recognize the fragments as executable code, strips out the @import, and the remaining characters reassemble into a working <svg onload=eval(atob(...))>.

What ZimReaper steals

The payload, dubbed ZimReaper, grabs the CSRF token and the password saved in the browser, pulls the two-factor authentication backup codes and the Zimbra version via the platform's own APIs, and disguises the exfiltration of data as DNS queries to the attackers' infrastructure. It then iterates through every two-character combination to dump the entire global address book, and sends the C2 server an archive of the victim's correspondence from the past 90 days.

One detail is especially nasty: the payload creates an application-specific password named ZimbraWeb, which grants access over IMAP, POP3 or SMTP with no two-factor authentication at all. At the Ukrainian hydrometeorological agency whose case was analyzed by Seqrite, the script additionally enabled IMAP. As the researchers note, such passwords survive a reset of the main password — so the patch closes the hole but does not revoke what has already been stolen.

The patch is only the beginning

Zimbra fixed the vulnerability on November 6, 2025; CISA added it to its catalog of actively exploited flaws on March 18, 2026. Affected versions are 10.0 up to 10.0.18 and 10.1 up to 10.1.13, with the 10.0 branch having reached end of life back on December 31, 2025. The latest release, 10.1.20 from July 20, closes four more XSS bugs in the same classic client.

According to the experts, an update is not enough: every mailbox where a suspicious message might have been opened should be considered potentially compromised — reset the password, terminate active sessions, regenerate the backup codes and check the audit.log for the creation of ZimbraWeb credentials.

The group is tracked by various researchers under the names TA488, CL-STA-1114, Void Blizzard and LAUNDRY BEAR, and Seqrite links the January episode to APT28 with medium confidence — there is no single mapping yet. Among the targets are government agencies, defense and research organizations in NATO countries, Ukraine, the CIS and Africa, as well as nuclear facilities in the United States. Proofpoint has recorded no TA488 activity since February 2026, but the advisory explicitly allows that the campaign may resume.

Source: The Hacker News