"a view-based exploit that only requires a user to view a malicious email," the joint NSA, CISA and partner advisory warned — and that description captures the core danger of CVE-2025-66376.
CVE-2025-66376: how Zimbra's Classic UI was abused
The flaw, CVE-2025-66376, is a stored cross-site scripting vulnerability in Zimbra's Classic Web Client. A crafted HTML email abuses CSS @import handling so that JavaScript executes inside an authenticated webmail session; when the message renders the payload inherits the user's mailbox access. The bug affects Zimbra Collaboration 10.0 before 10.0.18 and 10.1 before 10.1.13. Zimbra issued a fix on November 6, 2025, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on March 18, 2026.
Score disagreement exists in public records: the NVD assigns a CVSS score of 6.1 and says viewing the message counts as user interaction; MITRE scores it 7.2 and says it does not. Palo Alto Networks' Unit 42 describes the technique as zero-click; all three records agree on the observable behavior — the malicious code runs when the message is rendered.
ZimReaper: what the payload stole and how it worked
Proofpoint tracks the JavaScript as ZimReaper. The exploit hides an <svg onload> tag inside a display:none div, then fragments the tag with fake @import directives and HTML comments — a "tag-splitting" technique that Zimbra's sanitizer fails to recognise. Zimbra strips the @import sequences and the remaining characters coalesce into executable markup, which the browser runs (for example, <svg onload=eval(atob(...))>).
Once active, the script steals the CSRF token, the browser's autofilled password, 2FA scratch codes, and Zimbra version details via the platform's APIs. It exfiltrates data using DNS queries to actor infrastructure and brute-forces the Global Address List by querying two-character combinations until it reconstructs the directory. The payload then posts an archive containing the past 90 days of mail to a command-and-control server as a TGZ.
The JavaScript creates an app-specific password named ZimbraWeb via CreateAppSpecificPasswordRequest, which can grant IMAP, POP3 or SMTP access without two-factor enforcement. In a January case that Seqrite analyzed at a Ukrainian state hydrology agency, the payload also set zimbraPrefImapEnabled to TRUE; Seqrite noted that "App-specific passwords survive password resets."
Who was targeted, which groups are named, and what telemetry shows
The NSA, CISA and partner agencies published a joint advisory alongside research from Palo Alto Networks' Unit 42 and Proofpoint. Unit 42 (tracking the activity as CL-STA-1114) and Proofpoint (tracking the actor as TA488) say the campaign targeted Western government and commercial organizations since at least July 2025. Unit 42's sector-and-region summary lists government, defense, transportation and financial organizations in NATO member states, Ukraine, the Commonwealth of Independent States and Africa. Proofpoint adds U.S. targets including government, scientific and defense industrial base entities, including nuclear installations.
Vendor telemetry diverges on timing and continuity. Proofpoint said it "has not observed any activity from TA488 since February 2026" and tied the silence to Seqrite's disclosure and the actor tearing down infrastructure. Unit 42 reports that actors continue actively targeting unpatched Zimbra instances without specifying whether the same cluster remains active. The advisory assesses the group will "very likely" keep after Zimbra and other Western email systems.
Community naming varies: the advisory lists LAUNDRY BEAR, Void Blizzard, CL-STA-1114 and TA488, and cautions mappings may not be one-to-one. The Hacker News found the same nine domains in Unit 42's and Proofpoint's indicator lists, suggesting shared infrastructure; Unit 42 counted nine C2 IP addresses and nine domains with an average server life of 35.4 days.
Patch, then check accounts — concrete remediation and detection steps
Patching is the first imperative: upgrade 10.1 deployments to at least 10.1.13 and move 10.0 deployments onto a supported 10.1 build (10.0 reached end of life on December 31, 2025, making 10.0.18 an emergency floor). Zimbra's newest 10.1 release, 10.1.20, published July 20, 2026, fixes four additional stored XSS flaws in the Classic Web Client. Importantly, applying the update fixes the vulnerability but does not revoke credentials or app-specific passwords the payload already obtained.
Proofpoint's and Seqrite's guidance for post-compromise checks includes:
- Review /opt/zimbra/log/audit.log for CreateAppSpecificPassword calls and remove any credential named ZimbraWeb.
- Find accounts with zimbraPrefImapEnabled set to TRUE that lack a business need for IMAP, and remediate them.
- Alert on SOAP calls to GetScratchCodesRequest, which should be rare.
- Filter DNS for the published C2 domains and alert on long random subdomain lookups used for exfiltration.
- Pull messages that landed but were never opened and check their HTML for the fragmented @import pattern; Proofpoint published a YARA rule to match this.
What this means for defenders, policymakers, and affected enterprises
Technologists and security teams: patch immediately and treat any mailbox that opened or previewed a crafted message in a vulnerable Classic UI session as potentially compromised; reset passwords, invalidate sessions and regenerate 2FA scratch codes.
Policymakers and incident responders: the advisory warns continued pressure on Western email systems; inclusion on CISA's Known Exploited Vulnerabilities catalog reflects operational risk and prioritisation for managed remediation.
Affected enterprises and IT owners: patching closes the exploit vector but does not erase credentials taken earlier; account and mail archive reviews — including audit.log and SOAP-call monitoring — are necessary follow-ups.
Fixing the Classic UI hole stops the next malicious message from executing; it does not, by itself, revoke credentials, app-specific passwords or the copies of mail an attacker already exfiltrated. The advisory's blunt prescription — patch, then inspect accounts and logs — is the narrow, urgent work that follows the broader alarm: attackers exploited a view-triggered flaw for months, and the record now shows both how they worked and how defenders must respond.
https://thehackernews.com/2026/07/russian-espionage-group-exploited.html