Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-sponsored espionage group (TA488) exploited a zero-day stored XSS vulnerability (CVE-2025-66376) in Zimbra Collaboration Server to compromise Western government and commercial entities. The exploit is "zero-click" regarding user interaction, executing malicious JavaScript via CSS @import tag-splitting techniques when an email is merely viewed or rendered. The malware, named ZimReaper, exfiltrates emails, browser passwords, 2FA scratch codes, and creates persistent app-specific pa
Analysis
TL;DR
- A Russian state-sponsored espionage group (TA488) exploited a zero-day stored XSS vulnerability (CVE-2025-66376) in Zimbra Collaboration Server to compromise Western government and commercial entities.
- The exploit is "zero-click" regarding user interaction, executing malicious JavaScript via CSS @import tag-splitting techniques when an email is merely viewed or rendered.
- The malware, named ZimReaper, exfiltrates emails, browser passwords, 2FA scratch codes, and creates persistent app-specific passwords to maintain access even after password resets.
- Zimbra released patches for versions 10.0.18 and 10.1.13 in November 2025, but the vulnerability was actively exploited for at least five months prior to the fix.
- Immediate remediation requires patching, auditing logs for specific SOAP calls and IMAP preferences, and resetting credentials for any affected accounts.
Why It Matters
This incident highlights the critical risk of "view-based" exploits in enterprise communication platforms, where traditional security controls like click-awareness are bypassed by automatic rendering engines. It demonstrates how sophisticated threat actors can leverage obscure sanitization flaws in widely used software to establish long-term persistence and exfiltrate high-value intelligence from critical infrastructure sectors. For AI and cybersecurity practitioners, it underscores the necessity of monitoring client-side rendering behaviors and validating third-party library updates against emerging zero-day threats.
Technical Details
- Vulnerability Mechanism: CVE-2025-66376 is a stored cross-site scripting (XSS) flaw in Zimbra's Classic UI. Attackers use a "tag-splitting" technique, hiding an
<svg onload>tag within adisplay:nonediv and breaking it apart with fake@importdirectives and HTML comments. The Zimbra sanitizer strips the imports, leaving behind executable JavaScript that runs upon message render. - Malware Capabilities (ZimReaper): The payload steals CSRF tokens, autofilled passwords, and 2FA recovery codes. It uses the platform's own APIs to brute-force the Global Address List and exfiltrates 90 days of email as a TGZ archive over DNS queries to Command and Control (C2) servers.
- Persistence Method: The malware creates an app-specific password named
ZimbraWebviaCreateAppSpecificPasswordRequest, granting IMAP/POP3/SMTP access without requiring two-factor authentication. It also setszimbraPrefImapEnabledto TRUE, ensuring access survives password resets. - Target Scope: The campaign targeted government, defense, transportation, and financial organizations in NATO states, Ukraine, the CIS, Africa, and US nuclear installations. C2 infrastructure consisted of at least nine IPs and domains, each active for an average of 35.4 days.
- Remediation Steps: Organizations must upgrade to Zimbra 10.1.20 or later, audit
/opt/zimbra/log/audit.logforCreateAppSpecificPasswordcalls, disable IMAP for non-essential accounts, alert onGetScratchCodesRequestSOAP calls, and filter DNS for known C2 domains.
Industry Insight
- Shift in Exploit Delivery: Security teams must adapt to threats that do not require user clicks. Email gateways and clients should prioritize strict content sanitization and disable automatic HTML rendering for untrusted sources to mitigate view-based XSS attacks.
- Credential Hygiene and Persistence: The ability of malware to create app-specific passwords that survive main account resets indicates a need for stricter monitoring of API-level credential generation. Regular audits of active sessions and app-specific tokens are essential for detecting hidden persistence mechanisms.
- Supply Chain and Third-Party Risk: As Zimbra is a common platform for enterprises, the delay between vulnerability discovery and patching (five months in this case) emphasizes the importance of proactive vulnerability management and rapid response protocols for critical communication infrastructure.
Disclaimer: The above content is generated by AI and is for reference only.