Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-supported espionage group exploited a zero-click vulnerability in Zimbra's webmail client to steal email data, two-factor codes, and credentials from Western government and commercial organizations since July 2025. The flaw, CVE-2025-66376, is a stored cross-site scripting vulnerability in Zimbra's Classic UI. The group uses a 'view-based exploit' – simply opening a malicious email – to initiate the attack, accessing the last 90 days of email, the entire email directory, saved passwords, and two-factor recovery codes. The NSA, CISA, and partner agencies published a joint advisory on the campaign, alongside research from Palo Alto Networks' Unit 42 and Proofpoint.

Unit 42 and Proofpoint track the group under various names – LAUNDRY BEAR, Void Blizzard, CL-STA-1114, and TA488 – and describe the technique as a zero-click. The group uses a tag-splitting technique to bypass security measures, inserting an SVG tag with an onload attribute inside a hidden div, then breaking it apart with fake @import directives and HTML comments. Zimbra's sanitizer does not recognize these fragments as executable markup, allowing the browser to run the code. The payload mints an app-specific password named ZimbraWeb, which can grant IMAP, POP3, or SMTP access without two-factor authentication.

Proofpoint reported that the adversary used Proton Mail accounts and previously compromised addresses to send the malicious emails. Unit 42 identified nine C2 IP addresses and nine domains, each active for an average of 35.4 days. The advisory notes that the group will likely continue targeting Zimbra and other Western email systems even after organizations patch the vulnerability. Defenders should review logs for calls to CreateAppSpecificPassword and remove any credential named ZimbraWeb, and alert on SOAP calls to GetScratchCodesRequest.