**Critical Zero-Click Exploit in Zimbra Email: What Organizations Must Know**
A Russian state-sponsored espionage group has exploited a previously unknown flaw in Zimbra’s webmail client to conduct months-long espionage operations targeting Western government and commercial entities. Security researchers from Palo Alto Networks’ Unit 42 and Proofpoint, in coordination with the NSA and CISA, have detailed a “view-based” attack that requires nothing more than viewing a malicious email to compromise a mailbox.
### How the Attack Works
The vulnerability, tracked as **CVE-2025-66376**, is a stored cross-site scripting (XSS) flaw in Zimbra’s Classic Web Interface. It allows attackers to execute JavaScript inside an authenticated session simply by tricking a user into opening a specially crafted HTML email.
According to the joint advisory, the payload:
– Targets the last 90 days of emails
– Steals the entire email directory
– Captures browser-saved passwords
– Retrieves two-factor authentication (2FA) scratch codes
– Can be triggered with zero user interaction beyond viewing the message
The technique uses **tag-splitting** to evade detection. Attackers hide an `svg onload` tag inside a hidden `div`, then break the malicious script into fragments using fake `@import` CSS directives. When Zimbra’s sanitizer strips these fragments, the leftover characters reconstruct into a working exploit: ``.
### Attribution and Scope
Researchers track the actor under multiple names—**TA488**, **CL-STA-1114**, **LAUNDRY BEAR**, and **Void Blizzard**—with activity dating back to at least July 2025. Unit 42 notes the group is still actively exploiting unpatched systems, while Proofpoint reported a pause after February 2026, possibly linked to infrastructure takedowns or public disclosures.
The campaigns have targeted:
– Government agencies
– Defense organizations
– Transportation sectors
– Financial institutions
– Nuclear facilities
Evidence suggests the group used compromised Proton Mail accounts and previously breached email servers to send lures. The emails often arrived disguised as news digests.
### Impact and Payload Behavior
Once inside, the malware:
– Creates an app-specific password named **ZimbraWeb**
– Enables IMAP access without 2FA
– Brute-forces the Global Address List
– Exfiltrates 90 days of emails as a compressed archive
– Communicates with at least nine command-and-control (C2) servers
Even after patching, already-compromised accounts remain vulnerable. Rotating credentials and revoking active sessions is essential.
### Recommended Actions
1. **Apply patches immediately**
– Zimbra 10.0 users must upgrade to **10.0.18** or higher (end-of-life was Dec 31, 2025).
– Zimbra 10.1 users should move to **10.1.13+**, ideally **10.1.20**, which addresses additional XSS flaws.
2. **Conduct thorough account reviews**
– Reset passwords and revoke all active sessions for at-risk users.
– Regenerate 2FA scratch codes.
– Audit for suspicious app-specific passwords (e.g., “ZimbraWeb”).
– Check for `zimbraPrefImapEnabled` flags set without business justification.
3. **Monitor for indicators of compromise**
– Watch for SOAP calls to `GetScratchCodesRequest`
– Alert on DNS queries to known C2 domains
– Use Proofpoint’s published YARA rule to detect leftover email fragments
### Frequently Asked Questions (FAQ)
**Q: Is this vulnerability patched?**
Yes. Zimbra released fixes on November 6, 2025. However, organizations using unsupported versions (such as Zimbra 10.0) cannot receive updates and must migrate to a supported release.
**Q: Does viewing the email count as user interaction?**
According to NVD, yes (CVSS 6.1). MITRATE and Unit 42 classify it as zero-click (CVSS 7.2), meaning no further action is needed for execution once the email is rendered.
**Q: What if my organization never opened the email?**
Messages that were received but not viewed should still be inspected. The exploit resides in the HTML body, and fragments may remain detectable using YARA rules or forensic tools.
**Q: Does patching remove already stolen data?**
No. Patching closes the door but does not erase credentials or exfiltrated data. Incident response, including password resets and session invalidation, is necessary.
**Q: Are only government agencies at risk?**
No. While government and defense entities are prominent targets, the campaign also affected financial, transportation, and scientific organizations—both in NATO countries and internationally.
—
### Conclusion
The Zimbra zero-click exploit represents a significant reminder that email remains one of the most effective attack vectors available to adversaries. While patching is the critical first step, a comprehensive response—including credential rotation, session invalidation, and deep log analysis—is essential to eliminate dormant threats. Organizations that delay remediation risk long-term compromise of sensitive communications and infrastructure. This incident underscores the need for continuous vigil、及时 patching, and robust email security monitoring across all platforms.
