Zimbra Collaboration Suite Zero Day Espionage Campaign

ZimbraZero-DayCyber EspionageCredential TheftRussia

A Russian state-supported espionage group exploited a stored cross-site scripting zero-day, CVE-2025-66376, in Zimbra Collaboration Suite's Classic Web Client, allowing malicious JavaScript to execute inside a victim's authenticated webmail session the moment a crafted email was opened or previewed, with no click, attachment, or further interaction required. The payload, tracked by Proofpoint as ZimReaper and referenced by CISA as Ulej, stole CSRF tokens, autofilled passwords, and two-factor authentication scratch codes, exfiltrated up to 90 days of email and the full Global Address List, and created a persistent "ZimbraWeb" app-specific password for continued mailbox access without further

Indicators of Compromise

Domains (9)

emailanalytics.com.uaanalyticemailmeter.commailnalysis.comzimbra-metadata.comzimbrasoft.com.uaistc-cloud.comsynacorzimbra.nlzimbrastat.comzmailanalytics.com

Hashes (4)

98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aafb1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead76060db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874

IPv4 (9)

185.86.79.9564.226.124.190193.238.152.66216.252.238.104104.248.134.194194.156.103.193216.252.238.1837.120.247.228216.252.238.64

CVEs (1)

CVE-2025-66376

Emails (3)

[email protected][email protected][email protected]

APT Groups

Void Blizzard

Notes

Notes/Conclusion<ul style="margin-top:0;margin-bottom:0;"><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;">Patching closes the vulnerability but does not revoke access or credentials already stolen during the exploitation window; the account and credential review steps in Remediation/Detections are as important as the version upgrade itself.</li><li style="list-style-type: disc; font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); font-variant: normal; vertical-align: baseline; white-space: pre;">Proofpoint states it has not observed TA488 activity since 02.2026, coinciding with Seqrite's public disclosure and the actor's teardown of its own infrastructure; Unit 42 states threat actors continue to actively target unpatched ZCS instances using this CVE. Both claims are vendor telemetry and are not mutually confirmed.</li></ul>Related SOCRadar platform modules: <a href="https://socradar.io/extended-threat-intelligence/attack-surface-management/">Attack Surface Management</a> | <a href="https://socradar.io/extended-threat-intelligence/cyber-threat-intelligence/">Cyber Threat Intelligence</a> | <a href="https://socradar.io/extended-threat-intelligence/">Extended Threat Intelligence</a><div> </div>

Mitigation

<span style="font-size: 13.5pt; font-family: Arial, sans-serif; color: rgb(18, 32, 46); background-color: transparent; font-weight: 700; font-variant: normal; vertical-align: baseline; white-space: pre-wrap;">Mitigation <ul style="margin-top:0;margin-bottom:0;"><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1051/">M1051</a>  – Update Software</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1050/">M1050</a>  – Exploit Protection</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1048/">M1048</a>  – Application Isolation and Sandboxing</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1021/">M1021</a>  – Restrict Web-Based Content</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1017/">M1017</a>  – User Training</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1018/">M1018</a>  – User Account Management</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1027/">M1027</a>  – Password Policies</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1032/">M1032</a>  – Multi-factor Authentication</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1026/">M1026</a>  – Privileged Account Management</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1041/">M1041</a>  – Encrypt Sensitive Information</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1060/">M1060</a>  – Out-of-Band Communications Channel</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1037/">M1037</a>  – Filter Network Traffic</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1031/">M1031</a>  – Network Intrusion Prevention</li><li style="list-style-type: disc; font-size: 11pt; background-color: transparent; font-variant: normal; vertical-align: baseline; white-space: pre;"><a href="https://attack.mitre.org/mitigations/M1057/">M1057</a>  – Data Loss Prevention</li></ul>