Russian State-Sponsored Espionage Campaign Exploits Zero-Click Zimbra Vulnerability to Infiltrate Western Government and Defense Infrastructure

In a sophisticated cyber espionage operation that spanned several months, a Russian state-supported threat group successfully compromised the mailboxes of numerous Western government and commercial organizations by exploiting a previously unknown vulnerability in the Zimbra Collaboration Suite. The campaign, which focused on high-value intelligence gathering, allowed adversaries to bypass modern security protocols, including two-factor authentication, to extract sensitive communications and internal directory data. According to joint findings from the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and international partners, the actors leveraged a "zero-click" exploit that required no interaction from the victim beyond simply opening or previewing a malicious email.

The vulnerability, tracked as CVE-2025-66376, is a stored cross-site scripting (XSS) flaw residing in the Zimbra Classic Web UI. By sending a specially crafted HTML email, the attackers were able to execute arbitrary JavaScript within the context of the user’s authenticated session. This execution allowed the malicious payload to inherit the user’s permissions, effectively granting the attackers full access to the mailbox and its associated metadata. Research from cybersecurity firms Palo Alto Networks’ Unit 42 and Proofpoint indicates that the campaign remained undetected for months, providing the Russian operatives with a significant window to exfiltrate data from strategic targets across NATO member states, Ukraine, and the United States.

Technical Analysis of CVE-2025-66376 and the ZimReaper Payload

The core of the exploit lies in how Zimbra’s Classic UI handled Cascading Style Sheets (CSS) @import directives. The attackers utilized a technique known as "tag-splitting" to evade the platform’s built-in HTML sanitizer. By hiding an svg onload tag inside a hidden div and breaking the tag apart with fake @import sequences and HTML comments, the malicious code appeared as non-executable markup to the security filters. However, when the browser rendered the email, it stripped the @import sequences, causing the remaining characters to coalesce into a functional JavaScript command: <svg onload=eval(atob(...))>.

Once executed, the JavaScript payload, dubbed "ZimReaper" by Proofpoint, initiated a comprehensive data harvesting routine. The script was designed to steal the user’s Cross-Site Request Forgery (CSRF) token and any passwords saved within the browser’s autofill feature. Furthermore, the payload utilized Zimbra’s own Application Programming Interfaces (APIs) to pull two-factor authentication (2FA) recovery codes and specific version details of the Zimbra installation.

The ZimReaper payload did not stop at credential theft. It was programmed to perform a brute-force query of the Global Address List (GAL), systematically searching for every two-character combination until the organization’s entire directory was reconstructed. Finally, the malware collected the last 90 days of the victim’s email history, compressed the data into a TGZ archive, and exfiltrated it to adversary-controlled infrastructure via DNS queries and HTTP POST requests.

Discrepancies in Vulnerability Severity and Classification

The classification of CVE-2025-66376 has been a point of contention among major cybersecurity authorities, highlighting the evolving nature of web-based exploits. The National Vulnerability Database (NVD) assigned the flaw a CVSS score of 6.1, categorizing it as requiring user interaction because the victim must "view" the email. Conversely, MITRE assigned a higher score of 7.2, arguing that the exploit is essentially "zero-click" because the malicious code executes automatically upon rendering the message in the preview pane—a standard behavior for most enterprise email users.

Unit 42 supported the "zero-click" assessment, noting that the technique represents a significant threat to organizations that rely on the Classic UI of Zimbra. Because the exploit triggers upon the mere act of reading a message, traditional "phishing awareness" training, which teaches users not to click links or open attachments, is ineffective against this specific vector.

Chronology of the Cyber Espionage Campaign

The campaign’s timeline reveals a well-coordinated effort to exploit the vulnerability before and after a patch became available.

• July 2025: The threat actors began targeting Western government, defense, and commercial entities. The exploits at this stage were "zero-day" attacks, as no patch existed for the vulnerability.
• November 6, 2025: Zimbra released an emergency update (version 10.1.13 and 10.0.18) to address the stored XSS flaw after being alerted to its active exploitation.
• December 31, 2025: Zimbra 10.0 officially reached its end-of-life (EOL) status, complicating the security posture for organizations that had not yet migrated to the 10.1 branch.
• January 2026: Security researchers at Seqrite analyzed a specific case involving a Ukrainian state hydrology agency, where the attackers had successfully modified account preferences to ensure persistent IMAP access.
• February 2026: Proofpoint observed the last known activity from the primary actor cluster (TA488), suggesting that the group may have shifted infrastructure or paused operations following public disclosures.
• March 18, 2026: CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies apply patches immediately.
• July 20, 2026: Zimbra released version 10.1.20 to address four additional stored XSS flaws, indicating a continuing trend of vulnerabilities within the Classic Web Client.

Attribution and Actor Infrastructure

Attribution of the campaign has linked the activity to established Russian intelligence-aligned groups, though naming conventions vary across the cybersecurity industry. The joint advisory identifies the actors under several aliases, including LAUNDRY BEAR, Void Blizzard, and APT28 (also known as Fancy Bear). While some vendors, such as Seqrite, attributed the activity to APT28 with medium confidence, Dutch intelligence services (AIVD and MIVD) have suggested that LAUNDRY BEAR may operate as a distinct entity or a specialized subgroup.

The infrastructure used in the campaign was extensive. Unit 42 identified at least nine command-and-control (C2) IP addresses and nine unique domains. Each server remained operational for an average of 35 days before being rotated to avoid detection. The initial delivery of the exploit often originated from adversary-controlled Proton Mail accounts or from previously compromised organizational addresses, using generic lures such as "news digests" to blend in with legitimate traffic.

One of the most critical aspects of the group’s strategy was the creation of persistence. The ZimReaper payload was observed using the CreateAppSpecificPasswordRequest function to generate a new application-specific password named "ZimbraWeb." This credential allows for continued access via IMAP, POP3, or SMTP protocols even if the user’s primary password is changed, and it typically bypasses multi-factor authentication requirements.

Targeted Sectors and Global Reach

The scope of the targeting reflects the strategic priorities of Russian state intelligence. The victims were not chosen at random but were instead concentrated in sectors vital to national security and economic stability.

1. Government and Diplomacy: Ministries of Foreign Affairs and state agencies within NATO member states and Ukraine were primary targets.
2. Defense Industrial Base (DIB): Organizations involved in military research, manufacturing, and nuclear installations in the United States were specifically identified as being at risk.
3. Critical Infrastructure: Transportation and financial organizations in Africa and the Commonwealth of Independent States (CIS) were also targeted, likely to monitor regional logistics and economic shifts.
4. Scientific Research: Research institutions handling sensitive technological data were included in the campaign’s broad net.

While the exact number of compromised organizations remains undisclosed, the advisory emphasizes that the threat actors showed a high level of persistence, often returning to previously compromised mailservers to launch further exploit attempts against secondary targets.

Remediation and Defensive Requirements

The NSA and CISA emphasize that simply applying the software patch is insufficient for organizations that may have already been breached. Because the ZimReaper payload steals credentials and creates persistence mechanisms, a comprehensive incident response plan is required.

Immediate Actions for Administrators:

• Update Software: Ensure all Zimbra instances are running at least version 10.1.13 or the more recent 10.1.20. Organizations still on version 10.0 must migrate to a supported version immediately, as the 10.0 branch no longer receives security updates.
• Credential Resets: Force a password reset for all users, particularly those who utilize the Classic UI.
• Session Invalidation: Invalidate all active web sessions to kick out any unauthorized actors currently logged into the system.
• Audit App-Specific Passwords: Administrators should search the Zimbra environment for any application-specific passwords created during the window of exploitation, specifically looking for names like "ZimbraWeb."
• Regenerate 2FA Codes: Because the payload was capable of stealing 2FA recovery codes, these must be invalidated and regenerated for all high-value accounts.

Detection Strategies:
Defenders are encouraged to use YARA rules to scan historical email traffic for the fragmented @import pattern used in the tag-splitting technique. Furthermore, monitoring for unusual DNS queries and unauthorized IMAP/SMTP connections from unknown IP addresses can help identify accounts that remain under adversary control via app-specific passwords.

Broader Implications for Enterprise Email Security

The exploitation of CVE-2025-66376 highlights a growing trend in cyber espionage: the move toward "zero-click" vulnerabilities in ubiquitous web-based communication platforms. As organizations have bolstered their defenses against traditional malware and phishing links, state-sponsored actors have pivoted toward vulnerabilities that trigger automatically through the standard rendering processes of web browsers and mail clients.

This campaign also underscores the inherent risks associated with "legacy" user interfaces. The vulnerability specifically targeted Zimbra’s Classic UI, suggesting that older codebases within modern software suites remain a fertile ground for discovery by advanced persistent threat (APT) groups. For the cybersecurity community, the incident serves as a reminder that the "patch-and-forget" mentality is no longer viable. In the modern threat landscape, the act of patching must be accompanied by a thorough audit of account integrity to ensure that the "zombie" access granted by app-specific passwords and stolen 2FA codes is fully eradicated.

As geopolitical tensions continue to influence the digital domain, the NSA and its partners assess that Russian state-sponsored groups will almost certainly continue to target Western email systems. The success of the ZimReaper campaign provides a blueprint for future operations, making the rapid adoption of robust, multi-layered defense strategies a matter of national security for affected states.