Loading malware…
ZimReaper is a browser-executed JavaScript infostealer targeting authenticated sessions in Zimbra Collaboration Suite’s Classic Web Client. It is associated with the Russia-aligned espionage actor TA488, also known as Void Blizzard and Laundry Bear. Campaigns observed from at least July 2025 targeted Ukrainian government entities and U.S. government, education, scientific, nuclear, and defense industrial base organizations.
ZimReaper is delivered through crafted HTML phishing emails exploiting CVE-2025-66376, a stored cross-site scripting vulnerability in Zimbra’s HTML sanitization. Opening or previewing a malicious message is sufficient to execute the payload, without clicking a link or opening an attachment. The exploitation chain uses fragmented markup, fake CSS import directives, and HTML comments to bypass sanitization. Later campaign variants incorporated XOR obfuscation to evade secure email gateways.
Once executing inside the authenticated webmail session, ZimReaper contacts command-and-control infrastructure and steals the victim’s email address, CSRF token, and browser-autofilled password. It queries Zimbra APIs for installation details and two-factor authentication recovery codes, and creates an application-specific password that provides persistent IMAP, POP3, or SMTP access without the normal two-factor authentication requirement. It systematically enumerates the organization’s Global Address List using two-character search combinations and attempts to export up to 90 days of accessible email. Credentials and other small data items are exfiltrated through DNS queries, while mailbox exports are transmitted as compressed archives through HTTP POST requests. ZimReaper is the predecessor of OWAReaper, a related JavaScript implant adapted to Outlook Web Access.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Proofpoint tracks this malware family as ZimReaper. ZimReaper then uses Zimbra APIs to conduct reconnaissance against the device and gather two-factor authentication codes.
Proofpoint tracks this malware family as ZimReaper. ZimReaper then uses Zimbra APIs to conduct reconnaissance against the device and gather two-factor authentication codes.
TA458 and Void Blizzard exploited the “Half-click” vulnerability in Zimbra, Outlook Web Access, Roundcube, and SOGo to use ZimReaper and OWAReaper to collect credentials, contacts, and emails, and establish long-term persistence.
...ultimately resulting in the deployment of a JavaScript payload dubbed ZimReaper that's capable of harvesting 90 days of the victim's mail and other valuable data.
Once the JavaScript payload, dubbed ZimReaper by Proofpoint, executes, it performs the following malicious actions: steals the CSRF token and the browser's autofilled password, retrieves 2FA scratch codes, creates an app-specific password named ZimbraWeb, brute-forces the Global Address List, and exfiltrates 90 days of the victim's mail.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Compromised mailboxes also helped the group reach new targets. Messages sent from legitimate accounts were more likely to appear credible, giving TA488 another route for delivering exploit emails to government and commercial organizations.
ZimReaper creates an app-specific password named to look like a normal web client. That credential grants IMAP, POP3, and SMTP access without any two-factor prompt.
La technique dite half-click exploit ne nécessite que l’ouverture ou la prévisualisation de l’email pour déclencher l’exécution du code malveillant, sans aucune interaction supplémentaire.
MITRE ATT&CK Mapping Tactic Technique ID Technique Name Initial Access T1190 Exploit Public-Facing Application
Last month, the U.S. government disclosed details of a phishing campaign orchestrated by a Russia-linked adversary called Laundry Bear... that involved targeting Zimbra mail servers belonging to Western government and commercial organizations since at least July 2025.
the vulnerability allowed attackers to compromise users by merely opening or previewing a specially crafted HTML email in a Zimbra session that was vulnerable.
The browser, however, stitched the fragments back into a working event handler and ran the attacker’s JavaScript.
The campaign was found to have weaponized CVE-2025-66376, a stored cross-site scripting vulnerability in Zimbra's Classic UI, to deliver a malicious JavaScript payload dubbed ZimReaper to harvest email communications and other sensitive data.
TA458 and Void Blizzard exploited the “Half-click” vulnerability in Zimbra, Outlook Web Access, Roundcube, and SOGo
ZimReaper creates an app-specific password named to look like a normal web client. That credential grants IMAP, POP3, and SMTP access without any two-factor prompt.
Création d’un mot de passe applicatif nommé “ZimbraWeb” pour un accès persistant via IMAP/POP3/SMTP sans 2FA
The payload mints an app-specific password named ZimbraWeb through CreateAppSpecificPasswordRequest , which can grant IMAP, POP3 or SMTP access without two-factor authentication.
The payload mints an app-specific password named ZimbraWeb through CreateAppSpecificPasswordRequest , which can grant IMAP, POP3 or SMTP access without two-factor authentication.
ZimReaper creates an app-specific password named to look like a normal web client. That credential grants IMAP, POP3, and SMTP access without any two-factor prompt.
Création d’un mot de passe applicatif nommé “ZimbraWeb” pour un accès persistant via IMAP/POP3/SMTP sans 2FA
Depuis octobre 2025, le payload est enveloppé dans une boucle XOR avec une clé de 10 caractères changeant à chaque campagne pour contourner les passerelles email sécurisées.
ZimReaper creates an app-specific password named to look like a normal web client. That credential grants IMAP, POP3, and SMTP access without any two-factor prompt.
The payload mints an app-specific password named ZimbraWeb through CreateAppSpecificPasswordRequest , which can grant IMAP, POP3 or SMTP access without two-factor authentication.
MITRE ATT&CK Mapping Tactic Technique ID Technique Name Credential Access T1003 OS Credential Dumping (Browser Passwords)
Then it brute-forces the Global Address List, querying every two-character combination until the whole list comes back
Impact: Full account takeover — attackers steal session tokens, 2FA codes, browser-saved passwords, the entire Global Address List, and up to 90 days of mailbox data.
Vol du token CSRF et du mot de passe auto-complétion
Vol du token CSRF et du mot de passe auto-complétion
It then creates two invisible input elements in the DOM and waits for the browser's autofill to enter the username and password to gather the user’s OWA saved credentials.
The payload mints an app-specific password named ZimbraWeb through CreateAppSpecificPasswordRequest , which can grant IMAP, POP3 or SMTP access without two-factor authentication.
It steals ... the codes kept for two-factor recovery ... pulls 2FA scratch codes ... Alert on SOAP calls to GetScratchCodesRequest , which should be close to absent in normal use
the ZimReaper malware harvested ... recovery codes for two-factor authentication.
Enumération de la Global Address List (toutes combinaisons de 2 caractères)
TA488 then used compromised mailboxes to send the next round of exploit emails, which made those lures look legitimate.
attackers also created app-specific passwords for retaining persistent access to compromised accounts even after password changes.
local system data collection... were repeatedly observed.
MITRE ATT&CK Mapping Tactic Technique ID Technique Name Collection T1114 Email Collection
Exfiltration des 90 derniers jours d’emails via HTTP POST (format TGZ)
Previously, the same hackers leveraged another XSS vulnerability ... to deliver malware ZimReaper that steals email communication, two-factor authentication (2FA) codes, application passcodes, and passwords.
and posts 90 days of the victim's mail to the C2 as a TGZ archive.
Exfiltration via requêtes DNS (données encodées en Base32)
Ping du serveur C2 pour confirmer l’exploitation ... Exfiltration via requêtes DNS ... Exfiltration des 90 derniers jours d’emails via HTTP POST
Stolen information was transmitted through DNS requests and web traffic to attacker-controlled servers.
Besides exfiltrating data through DNS queries, attackers also created app-specific passwords for retaining persistent access
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.