Actor Profile

A Russian state-sponsored espionage group conducted a sustained campaign exploiting a zero-day vulnerability in Zimbra's webmail client. The actor, tracked as TA488 by Proofpoint and CL-STA-1114 by Unit 42, operated undetected for at least five months during 2025, targeting Western government and commercial organizations. The group's motivation aligns with strategic intelligence collection, focusing on government, defense, transportation, financial, scientific, and defense industrial base entities. The campaign demonstrates sophisticated tradecraft including zero-click exploitation, DNS-based exfiltration, and persistence mechanisms designed to survive credential resets.

TTPs (Tactics, Techniques, Procedures)

The actor exploited CVE-2025-66376, a stored cross-site scripting vulnerability in Zimbra Classic UI (T1189: Drive-by Compromise, T1203: Exploitation for Client Execution). Initial access required only viewing a malicious email containing fragmented SVG onload tags hidden via CSS @import abuse and HTML comments (tag-splitting technique). The JavaScript payload, tracked as ZimReaper, performed credential harvesting including CSRF tokens, browser-saved passwords, 2FA scratch codes, and created app-specific passwords named "ZimbraWeb" for persistence (T1555: Credentials from Password Stores, T1539: Steal Web Session Cookie). Data collection included 90 days of email history, Global Address List enumeration via brute-force, and Zimbra version fingerprinting (T1114: Email Collection, T1087: Account Discovery). Exfiltration occurred over DNS queries using long random subdomains to actor-controlled infrastructure, with email archives sent as TGZ files to C2 servers (T1048: Exfiltration Over Alternative Protocol, T1041: Exfiltration Over C2 Channel). The actor maintained an average C2 infrastructure lifespan of 35.4 days across at least nine domains and nine IP addresses. Phishing emails originated from adversary-controlled Proton Mail accounts and previously compromised addresses, often disguised as news digests (T1566: Phishing). Post-compromise, actors enabled IMAP access and sent additional exploit emails from compromised mailservers (T1534: Internal Spearphishing, T1078: Valid Accounts).

Targets & Patterns

The campaign targeted Western government and commercial organizations across NATO member states, Ukraine, the Commonwealth of Independent States, and Africa. Specific sectors included government agencies, defense organizations, transportation, financial institutions, scientific entities, and defense industrial base organizations including nuclear installations in the United States. Proofpoint confirmed targeting of US government, scientific, and defense industrial base entities. One confirmed victim was a Ukrainian state hydrology agency compromised in January 2026. The targeting pattern reflects strategic intelligence priorities consistent with Russian state interests: military and defense capabilities, critical infrastructure, government policy and communications, and geopolitical adversaries. The broad geographic and sectoral scope suggests an intelligence collection mandate rather than narrowly focused operations. Organizations running Zimbra Collaboration Suite, particularly those in government and defense sectors, faced elevated risk during the zero-day exploitation window from at least July 2025 through November 2025.

Historical Context

The campaign was active from at least July 2025, with the actor exploiting CVE-2025-66376 as a zero-day for approximately five months before Zimbra issued a patch on November 6, 2025. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on March 18, 2026, indicating confirmed in-the-wild exploitation. A joint advisory from NSA, CISA, and partner agencies was published in July 2026, alongside research from Palo Alto Networks Unit 42 and Proofpoint. The advisory assessed that the group will very likely continue targeting Zimbra and other Western email systems even as organizations patch this specific vulnerability. Unit 42 reported that threat actors continue to actively target unpatched Zimbra Collaboration Suite instances as of the advisory publication date. The campaign represents a continuation of Russian state-sponsored targeting of Western communications infrastructure for intelligence collection purposes. Zimbra 10.0 reached end-of-life on December 31, 2025, and Zimbra released version 10.1.20 on July 20, 2026, patching four additional stored XSS flaws in the Classic Web Client, indicating ongoing security challenges with the platform.

Defensive Recommendations

  • Immediately upgrade Zimbra Collaboration Suite to version 10.1.13 or later (10.1.20 recommended); migrate all 10.0 deployments to supported 10.1 builds as 10.0 reached EOL December 31, 2025
  • Audit /opt/zimbra/log/audit.log for CreateAppSpecificPassword API calls and remove any credentials named 'ZimbraWeb'; reset passwords, invalidate active sessions, and regenerate 2FA scratch codes for all accounts that opened or previewed emails in vulnerable Classic UI sessions
  • Deploy YARA rules to scan email stores for fragmented @import patterns and SVG onload tags hidden in display:none divs; monitor SOAP API calls to GetScratchCodesRequest which should be rare in normal operations
  • Alert on DNS queries to published C2 domains and detect long random subdomain lookups characteristic of DNS exfiltration (T1048.003); review accounts with zimbraPrefImapEnabled set to TRUE without legitimate business need
  • Implement email security controls to detect and block stored XSS attempts in HTML email bodies (T1566.001); consider disabling Zimbra Classic UI in favor of Modern UI where feasible to reduce attack surface

---

# Geopolitical Context

Geopolitical Context

The campaign, attributed to a Russian state-sponsored espionage group and tracked as TA488 (Proofpoint) and CL-STA-1114 (Unit 42), represents a sustained intelligence collection effort targeting Western government and commercial entities. The exploitation of CVE-2025-66376, a stored cross-site scripting vulnerability in Zimbra Collaboration's Classic UI, began at least five months before vendor disclosure in November 2025, indicating advanced capability development. The zero-click nature of the exploit—requiring only message rendering to execute—and the comprehensive data exfiltration (90 days of email, credentials, 2FA recovery codes, and directory information) suggest a priority intelligence requirement focused on strategic communications access. The targeting pattern spans NATO member states, Ukraine, the Commonwealth of Independent States, and Africa, with specific focus on government, defense, transportation, financial, scientific, and nuclear sectors in the US and allied nations. This aligns with established Russian intelligence collection priorities around Western defense posture, Ukraine support networks, and critical infrastructure. The use of compromised infrastructure for lateral movement and the creation of persistent access mechanisms (app-specific passwords surviving credential resets) indicates operational sophistication consistent with APT-level tradecraft.

State Actor Alignment

The activity is attributed by NSA, CISA, and partner agencies to a Russian state-sponsored espionage group, with private sector tracking designations TA488 (Proofpoint) and CL-STA-1114 (Unit 42). The joint advisory from US government agencies signals high confidence in attribution and reflects coordinated Western intelligence community assessment. CISA's addition of CVE-2025-66376 to the Known Exploited Vulnerabilities catalog on March 18, 2026, indicates the vulnerability meets the threshold for active exploitation by threat actors posing significant risk to federal enterprises. The targeting of NATO members, Ukraine, and US defense industrial base entities—including nuclear installations—is consistent with Russian Federation intelligence priorities documented in previous campaigns. No specific sanctions or policy responses are detailed in the available reporting, though the multi-agency advisory format typically precedes coordinated defensive measures and potential diplomatic or economic countermeasures. The campaign's continuation despite public disclosure suggests either operational necessity or calculated risk acceptance by the sponsoring state apparatus.

Business Impacty pro region

The campaign's geographic scope directly impacts transatlantic security coordination and Ukraine defense support networks. Targeting of NATO member states and Ukraine simultaneously threatens alliance cohesion and operational security for military assistance programs, particularly as the conflict in Ukraine continues. Compromise of government and defense sector communications in multiple NATO countries could expose classified or sensitive discussions on defense planning, sanctions policy, and Ukraine support mechanisms. The inclusion of Commonwealth of Independent States targets suggests intelligence collection on regional actors' positions relative to Russia, while African targeting may relate to influence competition and resource security interests. For European organizations, the campaign underscores persistent exposure through widely deployed collaboration platforms—Zimbra maintains significant market share in European government and education sectors. The five-month window of zero-day exploitation before vendor patch availability highlights the challenge facing resource-constrained public sector IT teams in smaller NATO and partner nations. The exfiltration of organizational directories and credential material creates cascading risk for partner organizations and allied information sharing arrangements, potentially chilling intelligence cooperation if partner security posture is perceived as compromised.

Forecast

If organizations fail to upgrade Zimbra deployments beyond version 10.1.13 and conduct comprehensive account remediation, the threat actors are very likely to maintain persistent access to compromised environments, as app-specific passwords survive standard password resets. If the attributed group continues to prioritize Western email systems—as assessed by the joint advisory—organizations running end-of-life Zimbra 10.0 instances face elevated risk of compromise, particularly in sectors aligned with documented targeting (government, defense, critical infrastructure). If geopolitical tensions between Russia and Western nations remain elevated or escalate, intelligence collection activity against the documented target set is likely to intensify, potentially shifting to alternative collaboration platforms as Zimbra patching rates improve. If compromised credentials and directory information are leveraged for follow-on operations, secondary intrusions via IMAP/POP3/SMTP access or social engineering against exfiltrated contact lists may emerge in coming months. If the campaign's operational security is maintained and C2 infrastructure continues rotating on 35-day cycles, detection and disruption will remain challenging absent proactive threat hunting using published indicators. Organizations that implement the recommended account audits and monitoring for anomalous SOAP API calls are more likely to detect residual compromise or reinfection attempts.