TL;DR
- what: Russian espionage group TA488 (CL-STA-1114) exploited CVE-2025-66376, a stored XSS flaw in Zimbra's Classic UI, as a zero-day for at least five months starting July 2025, running a payload the moment a victim viewed a crafted email.
- impact: The ZimReaper payload stole 90 days of mail, the browser-saved password, CSRF tokens, 2FA scratch codes and the full Global Address List, then created app-specific passwords that survive password resets.
- fix: Upgrade to Zimbra 10.1.13 or later (10.1.20 is current and fixes four more Classic UI XSS flaws), then reset credentials, kill sessions, regenerate scratch codes, and audit audit.log for CreateAppSpecificPassword entries named ZimbraWeb.
- who: Government, defense, transportation, financial, scientific and nuclear-adjacent organizations in NATO states, Ukraine, the CIS and Africa, plus any org still on unpatched Zimbra 10.0 or 10.1 Classic UI.
A Russian state-supported espionage group spent at least five months of 2025 reading Western mailboxes through a Zimbra flaw nobody else knew existed. The victim did not click anything. Viewing the email in Zimbra's Classic UI was enough to run a payload that pulled the last 90 days of mail, the browser-saved password, 2FA scratch codes and the organization's entire address book. NSA, CISA and partner agencies published a joint advisory on the campaign Thursday, alongside research from Palo Alto Networks Unit 42 and Proofpoint. The advisory says the actors have been compromising Western government and commercial organizations through Zimbra since at least July 2025.
The flaw: view and it runs
CVE-2025-66376 is a stored cross-site scripting vulnerability in the Zimbra Classic UI, affecting Zimbra Collaboration 10.0 before 10.0.18 and 10.1 before 10.1.13. A crafted HTML email abuses CSS @import handling to execute JavaScript inside the authenticated webmail session, so the payload inherits the user's full mailbox access. The two CVSS records disagree on whether viewing counts as user interaction: NVD scores it 6.1 and says yes, MITRE scores it 7.2 and says no, and Unit 42 flatly calls it zero-click. The distinction is academic. All three describe the same behavior: the message runs when it renders.
The evasion is the clever part. The exploit hides an svg onload tag inside a display:none div, then breaks the tag apart with fake @import directives and HTML comments, a technique Proofpoint calls tag-splitting. Zimbra's sanitizer does not recognize the fragments as executable markup. It strips the @import sequences, and the leftover characters reassemble into a working svg onload=eval(atob(...)) that the browser executes. The sanitizer itself completes the exploit.
What ZimReaper takes
Proofpoint, which tracks the actor as TA488, names the JavaScript payload ZimReaper. It steals the CSRF token and the browser's autofilled password, pulls 2FA scratch codes and version details through Zimbra's own APIs, and exfiltrates them over DNS queries to actor infrastructure. It then brute-forces the Global Address List by querying every two-character combination until the whole directory comes back, and posts 90 days of the victim's mail to the C2 as a TGZ archive. Unit 42, tracking the activity as CL-STA-1114, counted at least nine C2 IP addresses and nine domains, each server live for an average of 35.4 days. Delivery came from adversary-controlled Proton Mail accounts and previously compromised addresses, often dressed as a news digest.
⚠️ The patch closes the hole, not the account — Updating Zimbra does not revoke anything the payload already took. ZimReaper mints an app-specific password named ZimbraWeb via CreateAppSpecificPasswordRequest, which grants IMAP, POP3 or SMTP access without two-factor authentication, and app-specific passwords survive password resets. In one January case at a Ukrainian state hydrology agency, the payload also flipped zimbraPrefImapEnabled to TRUE. Proofpoint observed TA488 sending further exploit emails from compromised mailservers and could not determine which stolen credential got it back in.
Who was targeted
Unit 42's targeting list spans government, defense, transportation and financial organizations in NATO member states, Ukraine, the Commonwealth of Independent States and Africa. Proofpoint adds US government, scientific and defense industrial base entities, including nuclear installations. Neither vendor named affected organizations or gave a victim count, and both are careful to distinguish targeted from compromised. The timeline is less ambiguous: exploitation began by July 2025, Zimbra shipped the fix on November 6, 2025, and CISA added the CVE to the Known Exploited Vulnerabilities catalog on March 18, 2026.
Patch, then work the accounts
Zimbra 10.0 reached end of life on December 31, 2025, which makes 10.0.18 an emergency floor rather than a destination. The current release is 10.1.20, out July 20, and it fixes four more stored XSS flaws in the same Classic Web Client. Get 10.1 deployments to at least 10.1.13 and move 10.0 deployments onto a supported 10.1 build. Then treat any mailbox that opened or previewed a matching message in a vulnerable Classic UI session as potentially compromised: reset the password, invalidate active sessions, regenerate 2FA scratch codes. Unopened messages should be pulled and their HTML checked for the fragmented @import pattern, which Proofpoint's published YARA rule matches.
- Review /opt/zimbra/log/audit.log for CreateAppSpecificPassword calls and remove any credential named ZimbraWeb
- Find accounts with zimbraPrefImapEnabled set to TRUE that have no business need for IMAP
- Alert on SOAP calls to GetScratchCodesRequest, which should be nearly absent in normal use
- Filter DNS for the published C2 domains and alert on the long random subdomain lookups the payload uses for exfiltration
Is the campaign still live? — Depends on whose telemetry you read. Unit 42 says threat actors continue to actively target unpatched Zimbra instances with this flaw, without confirming this cluster is among them. Proofpoint has seen no TA488 activity since February 2026 and ties the silence to Seqrite's disclosure and the actor tearing down its own infrastructure. The joint advisory splits the difference: it warns of ongoing activity and assesses the group will very likely keep going after Zimbra and other Western email systems even if this specific campaign winds down.
The operational lesson is narrow and repeatable. A webmail XSS flaw is a full mailbox compromise with persistence, because the payload runs with the victim's session and the platform's own APIs hand over everything else. If your incident response plan for this class of bug ends at applying the patch, TA488 kept its access through exactly that gap. Patch the servers this week. Audit the app-specific passwords the same day.
Originally published on RedEye Threat Intelligence.
