{"id":1980,"date":"2026-07-23T19:04:25","date_gmt":"2026-07-23T19:04:25","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1980"},"modified":"2026-07-23T19:04:25","modified_gmt":"2026-07-23T19:04:25","slug":"russian-espionage-group-exploited-zimbra-zero-day-to-steal-mail-and-2fa-codes","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1980","title":{"rendered":"Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes"},"content":{"rendered":"
\n
<\/a><\/div>\n

A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra’s webmail client.<\/p>\n

The payload goes after the last 90 days of email, the organization’s entire email directory, the password saved in the browser and the codes kept for two-factor recovery. Opening the message was enough to start it.<\/p>\n

The NSA<\/a>, CISA and partner agencies published a joint advisory<\/a> on the campaign Thursday, alongside research from Palo Alto Networks’ Unit 42 and Proofpoint.<\/p>\n

The advisory calls the technique \u00aba view-based exploit that only requires a user to view a malicious email\u00bb in a vulnerable client. It says the actors have been targeting and compromising Western government and commercial organizations through Zimbra since at least July 2025.<\/p>\n

The flaw, CVE-2025-66376<\/code>, is a stored cross-site scripting vulnerability in Zimbra’s Classic UI. A crafted HTML email abuses CSS @import<\/code> handling to execute JavaScript inside an authenticated webmail session, so the payload inherits the user’s access to the mailbox.<\/p>\n

The two CVSS records disagree on whether viewing the message counts as user interaction: NVD scores it 6.1<\/a> and says it does; MITRE scores it 7.2 and says it does not. Unit 42 calls it zero-click. All three describe the same behavior: the message runs when it renders, and nothing else has to happen.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

It affects Zimbra Collaboration 10.0 before 10.0.18<\/code> and 10.1 before 10.1.13<\/code>. Zimbra fixed it<\/a> on November 6, 2025, and CISA added it to the Known Exploited Vulnerabilities catalog<\/a> on March 18, 2026. Proofpoint<\/a>, which tracks the actor as TA488, said the group exploited the bug as an unknown vulnerability for at least five months during 2025, before that fix existed.<\/p>\n

<\/p>\n

The patch closes the hole, not the account. An update does not revoke credentials the payload already took.<\/p>\n

Proofpoint said the messages went out from adversary-controlled Proton Mail accounts and from previously compromised addresses, using generic lures. Unit 42<\/a>, which tracks the activity as CL-STA-1114, said they were often dressed as a digest of current news. The exploit sits in the HTML body.<\/p>\n

It hides an svg onload<\/code> tag inside a display:none<\/code> div, then breaks the tag apart with fake @import<\/code> directives and HTML comments, a technique Proofpoint calls tag-splitting. Zimbra’s sanitizer does not recognize the fragments as executable markup. It strips the @import<\/code> sequences, and the characters left behind join into <\/code>, which the browser runs.<\/p>\n

\"\"<\/a><\/div>\n

Proofpoint tracks the JavaScript payload as ZimReaper. It steals the CSRF token and the browser’s autofilled password, pulls 2FA scratch codes and Zimbra version details through the platform’s own APIs, and exfiltrates them over DNS queries to actor infrastructure. Then it brute-forces the Global Address List, querying every two-character combination until the whole list comes back, and posts 90 days of the victim’s mail to the C2 as a TGZ archive.<\/p>\n

Unit 42 counted at least nine C2 IP addresses and nine domains, each server live for an average of 35.4 days. It named no affected organizations and gave no victim count. Its list of sectors and regions describes who was targeted. It does not say who was compromised. That list runs across government, defense, transportation and financial organizations in NATO member states, Ukraine, the Commonwealth of Independent States and Africa. Proofpoint puts US organizations on it too: government, scientific and defense industrial base entities, including nuclear installations.<\/p>\n

The payload mints an app-specific password named ZimbraWeb<\/code> through CreateAppSpecificPasswordRequest<\/code>, which can grant IMAP, POP3 or SMTP access without two-factor authentication. Proofpoint said TA488 went on to send further exploit emails from compromised mailservers, and could not say whether the app passwords or other stolen credentials were what got it back in.<\/p>\n

In the January case Seqrite analyzed<\/a>, at a Ukrainian state hydrology agency, the payload also flipped zimbraPrefImapEnabled<\/code> to TRUE. \u00abApp-specific passwords survive password resets,\u00bb the researchers wrote.<\/p>\n

Patch, then check the accounts<\/h2>\n

Zimbra 10.0 reached end of life<\/a> on December 31, 2025, which makes 10.0.18<\/code> an emergency floor rather than a destination. The newest 10.1 release is 10.1.20<\/code><\/a>, out July 20, which fixes four more stored XSS flaws in the Classic Web Client.<\/p>\n

Upgrade 10.1 deployments to at least 10.1.13<\/code>, and move 10.0 deployments onto a supported 10.1 build. Then work the accounts. Any mailbox that opened or previewed a matching message in a vulnerable Classic UI session should be treated as potentially compromised: reset the password, invalidate active sessions, and regenerate 2FA scratch codes.<\/p>\n

Messages that landed but were never opened should be pulled and their HTML checked for the fragmented @import<\/code> pattern, which Proofpoint’s published YARA rule matches. The update does none of the checks below.<\/p>\n

They come from Proofpoint’s and Seqrite’s guidance:<\/p>\n