Russian State-Sponsored Hackers Target Zimbra Servers

Originally published on CyberNetSec.

Executive Summary

U.S. and international cybersecurity agencies, including CISA, the NSA, and the FBI, have released a joint advisory warning of a sophisticated espionage campaign conducted by the Russian state-supported APT group Laundry Bear (also known as Void Blizzard, TA488). The campaign targets government and commercial organizations using Zimbra Collaboration Suite (ZCS). The actors are leveraging a "zero-click" exploit for CVE-2025-66376, a cross-site scripting (XSS) vulnerability. This allows them to compromise accounts and steal data simply when a user views a specially crafted email in the ZCS webmail client. The campaign has been active since at least July 2025 and continues to target unpatched servers to steal emails, credentials, and other sensitive information.

---

Threat Overview

The threat actor, Laundry Bear, is a well-known Russian APT group with a history of targeting entities for intelligence-gathering purposes. This latest campaign focuses on organizations in Western countries, including government agencies at the federal and local levels, the Defense Industrial Base (DIB), and various other sectors. The primary goal is the covert acquisition of email data.

The attack's novelty lies in its delivery mechanism. It is a "view-based" or "zero-click" attack that requires no user interaction beyond opening and viewing a malicious email within a vulnerable ZCS webmail interface. This bypasses common user security training focused on not clicking links or opening attachments.

The attack exploits CVE-2025-66376, an XSS vulnerability that was a zero-day when the campaign began. Although a patch was released in November 2025, the group continues to find and exploit unpatched servers. Upon viewing the email, a custom JavaScript payload and a data exfiltration tool named Ulej are deployed to the victim's session.

Technical Analysis

The attack chain is efficient and difficult to detect from a user perspective.

1. Initial Access: The actor sends a specially crafted email to a target using a vulnerable version of Zimbra Collaboration Suite. This maps to T1190 - Exploit Public-Facing Application.
2. Execution: When the email is viewed in the web client, the embedded malicious script executes in the context of the user's session due to the XSS vulnerability (T1059.007 - JavaScript).
3. Collection & Exfiltration: The executed script deploys the Ulej tool, which performs several collection actions:
   • Steals the last 90 days of emails.
   • Collects email addresses and passwords.
   • Exfiltrates the organization's Global Address List.
   • Steals two-factor authentication (2FA) tokens. This activity corresponds to T1114 - Email Collection and T1555 - Credentials from Password Stores. The stolen data is then exfiltrated to actor-controlled infrastructure (T1041 - Exfiltration Over C2 Channel).

The campaign's success hinges on organizations failing to patch publicly known vulnerabilities, demonstrating the effectiveness of targeting legacy or poorly maintained systems.

MITRE ATT&CK Techniques

• T1589 - Gather Victim Identity Information: Actors gather email addresses of targets in government and other sectors.
• T1190 - Exploit Public-Facing Application: Exploitation of CVE-2025-66376 in internet-facing Zimbra servers.
• T1059.007 - JavaScript: Malicious JavaScript is executed in the victim's browser session.
• T1114 - Email Collection: The Ulej tool is used to steal emails from the compromised account.
• T1555 - Credentials from Password Stores: The malware steals credentials and 2FA tokens.
• T1041 - Exfiltration Over C2 Channel: Stolen data is sent back to the threat actor's servers.

Impact Assessment

The impact of this campaign is significant due to the nature of the targets (government, DIB) and the sensitivity of the stolen data (emails, credentials). The zero-click nature of the exploit makes it particularly dangerous, as it can succeed even in organizations with a strong security awareness culture. For compromised entities, the breach could lead to the loss of sensitive government information, intellectual property, and strategic plans. The theft of credentials and address lists also provides the actor with resources for future campaigns, either against the same organization or its partners. Since July 2025, over 10 organizations have been confirmed victims, indicating a successful and ongoing operation.

IOCs — Directly from Articles

No specific technical indicators of compromise (e.g., IP addresses, domains, hashes) were provided in the source articles. The official CISA advisory AA26-205A should be consulted for detailed IOCs.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect related activity:

• Log Source: Zimbra webmail server logs, proxy logs, EDR logs.
• URL Pattern: Look for unusual or obfuscated JavaScript content being loaded in requests within the ZCS webmail interface. Pay attention to requests that do not match legitimate ZCS API calls.
• Network Traffic: Monitor for unexpected outbound connections from the Zimbra server or from user endpoints shortly after accessing the webmail client. Look for data transfers to unknown or suspicious domains.
• File System: On the Zimbra server, look for modifications to core application files or the presence of unauthorized scripts in web-accessible directories.

Detection & Response

• Vulnerability Scanning: Regularly scan for and identify all internet-facing Zimbra servers and verify they are patched against CVE-2025-66376.
• Log Analysis: As recommended by CISA, review Zimbra logs for indicators of exploitation. Look for anomalous GET/POST requests that contain script tags or other XSS payloads. Use D3-NTA: Network Traffic Analysis to identify unusual data flows from the ZCS server.
• Web Application Firewall (WAF): Deploy a WAF in front of Zimbra servers with rules designed to detect and block common XSS attack patterns.

Mitigation

• Patch Management: The most critical mitigation is to apply the patch for CVE-2025-66376 immediately. Prioritize all internet-facing Zimbra servers. This falls under M1051 - Update Software.
• Network Segmentation: Restrict access to the Zimbra web interface to only trusted networks where possible. Do not expose management interfaces to the public internet. This aligns with M1035 - Limit Access to Resource Over Network.
• Multi-Factor Authentication (MFA): While the Ulej tool can reportedly steal 2FA tokens, a robust, phishing-resistant MFA implementation (such as FIDO2) can still provide significant protection against credential abuse.