Loading story…
Palo Alto Networks Unit 42 reported that a cyberespionage campaign tracked as CL-STA-1114, overlapping with activity attributed by other vendors to Void Blizzard and LAUNDRY BEAR, has been exploiting Zimbra Collaboration Suite webmail servers at government, defense, transportation, and financial organizations. The activity has affected targets across NATO member states, Ukraine, CIS countries, and Africa, with researchers saying the broader cluster has been active since at least 2024 and Zimbra-focused operations began in July 2025.
The attackers used zero-click phishing emails to exploit CVE-2025-66376 in Zimbra webmail, allowing a malicious JavaScript payload to run in victims’ browsers without user interaction. Unit 42 said the malware can steal Zimbra credentials, CSRF tokens, 2FA scratch codes, system details, and up to 90 days of email and search history. Researchers also identified at least nine IP addresses and nine domains tied to command-and-control infrastructure, with servers remaining active for an average of 35.4 days, and warned that unpatched Zimbra instances are being actively targeted.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The campaign used zero-click phishing emails exploiting CVE-2025-66376 in Zimbra webmail to inject malicious JavaScript into victims’ browsers without user interaction. The payload exfiltrated credentials, CSRF tokens, 2FA scratch codes, system details, and up to 90 days of email and search history.
Unit 42 said the campaign targeting Zimbra Collaboration Suite webmail began in July 2025. The operation targeted organizations in government, defense, transportation, and finance across NATO member states, Ukraine, CIS countries, and Africa.
Unit 42 reported that the broader cyberespionage activity cluster tracked as CL-STA-1114 has been active since at least 2024. The activity overlaps with reporting by other vendors on the Russian threat actor Void Blizzard, also known as LAUNDRY BEAR.
On 2026-07-23, a joint alert from 27 US, UK, and other international government agencies warned that Russia-linked Laundry Bear/Void Blizzard had exploited CVE-2025-66376 in Zimbra since at least July 2025. The alert said the zero-click campaign targeted Western organizations across government, defense, education, energy, law enforcement, media, NGO, and technology sectors and advised reviewing published IOCs and minimizing Zimbra webmail use until patched.
On 2026-07-23, the UK NCSC and partners from 15 countries disclosed and attributed a zero-click phishing campaign against vulnerable Zimbra webmail instances to the Russian state-supported group LAUNDRY BEAR. The advisory said the espionage activity had been stealing sensitive email data since July 2025 and urged organizations to patch Zimbra systems and improve monitoring.
On 2026-07-23, Unit 42 publicly described the persistent cyberespionage campaign tracked as CL-STA-1114 and documented its overlap with activity attributed by other vendors to Void Blizzard/LAUNDRY BEAR. The report also noted at least nine IP addresses and nine domains used as command-and-control infrastructure and said attackers were actively targeting unpatched Zimbra instances.
CISA said Laundry Bear exploited CVE-2025-66376 as a zero-day before Zimbra patched the cross-site scripting flaw in November 2025. The vulnerability allowed crafted HTML emails in Zimbra Classic UI to execute JavaScript automatically and steal account data.
On 2026-03-18, CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities catalog after reporting that the Zimbra flaw had been exploited in the wild. The vulnerability had been used in a Russian espionage campaign targeting webmail users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
15 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecyberscoop.com
Open sourcemalware.news
Open sourcenextgov.com
Open sourceseqrite.com
Open sourcecve.org
Open sourceic3.gov
Open sourcemedia.defense.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical security vulnerability in Zimbra Collaboration Suite, tracked as CVE-2025-27915, was exploited as a zero-day in targeted cyberattacks against the Brazilian military. The flaw, a stored cross-site scripting (XSS) vulnerability in the Classic Web Client, resulted from insufficient sanitization of HTML content in ICS (iCalendar) calendar files. Attackers leveraged this vulnerability by sending malicious ICS files embedded with JavaScript code, which executed when a user viewed an email containing the crafted calendar entry. The JavaScript payload enabled arbitrary code execution within the victim's session, allowing attackers to perform unauthorized actions such as setting email filters to redirect messages to attacker-controlled addresses. This facilitated data exfiltration, including the theft of credentials, emails, contacts, and shared folders from compromised Zimbra accounts. The malicious campaign involved threat actors spoofing the Libyan Navy's Office of Protocol to deliver the exploit to Brazilian military targets. The ICS files used in the attack were notably large and contained obfuscated JavaScript, often encoded in Base64 to evade detection. The payload was designed to operate asynchronously and utilized Immediately Invoked Function Expressions (IIFEs) for execution. Researchers at StrikeReady Labs discovered the attack by monitoring for unusually large ICS attachments containing JavaScript. The campaign began at the start of January 2025, prior to Zimbra releasing patches for the vulnerability. Zimbra addressed the issue in versions 9.0.0 Patch 44, 10.0.13, and 10.1.5, released on January 27, 2025, but did not initially disclose that the vulnerability had been exploited in the wild. The attack also included mechanisms to hide certain user interface elements, further reducing the likelihood of detection by end users. The malicious script searched for emails in specific folders and added filter rules named "Correo" to forward messages to a ProtonMail address controlled by the attackers. The exfiltrated data was sent to an external server, ffrk[.]net, under the attackers' control. The exploitation of this vulnerability highlights the risks associated with insufficient input sanitization in webmail platforms and the effectiveness of social engineering tactics, such as spoofing trusted entities. The incident underscores the importance of timely patching and monitoring for anomalous file attachments in email systems. Security researchers recommend organizations using Zimbra Collaboration Suite apply the latest patches and review email filtering rules for signs of compromise. The attack demonstrates the evolving sophistication of threat actors in leveraging zero-day vulnerabilities for targeted espionage campaigns against high-value organizations.
Jun 29, 2026
Russia-aligned espionage groups **TA458** and **TA488** have been exploiting vulnerabilities in webmail platforms including **Roundcube, Zimbra, SOGo, mDaemon, Kerio,** and **SOGo** to compromise government and defense targets through so-called **"half-click"** attacks, where opening a malicious email in a webmail session triggers attacker-controlled JavaScript. Proofpoint reported TA458 used a **SOGo zero-day** later patched as `CVE-2026-8496`, while TA488 exploited a previously unknown **Zimbra** flaw assigned `CVE-2025-66376` for months. The campaigns targeted Ukrainian government entities, Eastern European military and government organizations, and parts of the U.S. defense industrial base and nuclear sector, with malware such as **SpyPress** and **ZimReaper** stealing credentials, contacts, emails, CSRF tokens, and app-specific passwords to bypass multifactor protections. Reporting on **APT28** infrastructure exposed in early 2026 tied the broader **Operation RoundPress** activity to a larger webmail espionage program that relied heavily on patched but unremediated flaws, including `CVE-2020-35730`, `CVE-2023-43770`, `CVE-2021-44026`, and `CVE-2020-12641` in Roundcube. Researchers said the leaked toolkit included XSS payloads, a Flask-based command-and-control server, a Go implant for GNU/Linux, operator bash history, and victim data, revealing poor operational security and overlap between staging, exfiltration, and pivot infrastructure. TA458 was also observed chaining a Roundcube XSS vector with `CVE-2025-49113` to achieve PHP deserialization and arbitrary code execution, showing that the actors are pursuing not only mailbox theft and forwarding-rule abuse but also persistent server-side access.
Jul 23, 2026
**APT28**, the Russia-linked threat group associated with the GRU, used a phishing campaign dubbed *Operation GhostMail* to target Ukrainian government entities by exploiting **Zimbra Collaboration Suite** vulnerability `CVE-2025-66376`. The campaign targeted the **State Hydrographic Service of Ukraine**, a critical infrastructure body supporting maritime navigation and hydrographic operations. The attack used a single email written in Ukrainian and disguised as a routine internship inquiry; instead of relying on attachments or links, the malicious payload was embedded directly in the HTML body and executed when opened in a vulnerable Zimbra webmail session. Researchers said the stored XSS flaw allowed attackers to run obfuscated JavaScript in the victim’s browser, enabling theft of login credentials, session tokens, backup two-factor authentication codes, browser-stored passwords, and up to 90 days of mailbox data. Reporting also notes the flaw was patched in November and later added by **CISA** to its **Known Exploited Vulnerabilities** catalog, with U.S. federal civilian agencies ordered to remediate within two weeks under `BOD 22-01`. The operation stood out for abusing a trusted webmail environment to hijack authenticated sessions without deploying traditional malware, helping the intrusion evade many standard phishing and endpoint defenses.
Jun 29, 2026