Russian Espionage Campaign Exploits Zimbra Webmail Zero-Click Flaw

Palo Alto Networks Unit 42 reported that a cyberespionage campaign tracked as CL-STA-1114, overlapping with activity attributed by other vendors to Void Blizzard and LAUNDRY BEAR, has been exploiting Zimbra Collaboration Suite webmail servers at government, defense, transportation, and financial organizations. The activity has affected targets across NATO member states, Ukraine, CIS countries, and Africa, with researchers saying the broader cluster has been active since at least 2024 and Zimbra-focused operations began in July 2025.

The attackers used zero-click phishing emails to exploit CVE-2025-66376 in Zimbra webmail, allowing a malicious JavaScript payload to run in victims’ browsers without user interaction. Unit 42 said the malware can steal Zimbra credentials, CSRF tokens, 2FA scratch codes, system details, and up to 90 days of email and search history. Researchers also identified at least nine IP addresses and nine domains tied to command-and-control infrastructure, with servers remaining active for an average of 35.4 days, and warned that unpatched Zimbra instances are being actively targeted.