9 minhigh
Russian Global Webmail Espionage
Unit 42 details CL-STA-1114, a Russian-nexus cyberespionage campaign overlapping with Void Blizzard/LAUNDRY BEAR, exploiting CVE-2025-66376 in Zimbra webmail through zero-click phishing emails containing obfuscated HTML/SVG that decodes and executes a Base64-encoded JavaScript payload in the victim's browser. The payload exfiltrates CSRF tokens, credentials, 2FA scratch codes, and up to 90 days of email/search history to hardcoded C2 servers, with at least nine IPs and nine domains identified as rotating infrastructure averaging 35.4 days of activity.
Sens:■ ImmediateConf:high
Showing defanged values
- domainanalyticemailmeter[.]comC2 domain used in CL-STA-1114 phishing/exfiltration infrastructure
- domainemailanalytics[.]com[.]uaC2 domain used in CL-STA-1114 phishing/exfiltration infrastructure
- domainistc-cloud[.]comC2 domain used in CL-STA-1114 phishing/exfiltration infrastructure
- domainmailnalysis[.]comC2 domain used in CL-STA-1114 phishing/exfiltration infrastructure
- domainsynacorzimbra[.]nlC2 domain masquerading as Zimbra/Synacor-related infrastructure
- domainzimbra-metadata[.]comC2 domain used for exfiltration of stolen Zimbra webmail credentials and session data
- domainzimbrasoft[.]com[.]uaC2 domain used to receive exfiltrated webmail data from compromised targets
- domainzimbrastat[.]comC2 domain masquerading as Zimbra-related infrastructure for data exfiltration
- domainzmailanalytics[.]comC2 domain used in CL-STA-1114 phishing/exfiltration infrastructure
- ip104[.]248[.]134[.]194C2 server IP associated with CL-STA-1114 campaign infrastructure
- ip185[.]86[.]79[.]95C2 server IP associated with CL-STA-1114 campaign infrastructure
- ip193[.]238[.]152[.]66C2 server IP associated with CL-STA-1114 campaign infrastructure
- ip194[.]156[.]103[.]193C2 server IP associated with CL-STA-1114 campaign infrastructure
- ip216[.]252[.]238[.]104C2 server IP associated with CL-STA-1114 campaign infrastructure
- ip216[.]252[.]238[.]18C2 server IP associated with CL-STA-1114 campaign infrastructure
- ip216[.]252[.]238[.]64C2 server IP associated with CL-STA-1114 campaign infrastructure
- ip37[.]120[.]247[.]228C2 server IP address associated with CL-STA-1114 exfiltration infrastructure
- ip64[.]226[.]124[.]190C2 server IP address associated with CL-STA-1114 exfiltration infrastructure
Detection / HunterAnthropic
What Happened
Security researchers at Unit 42 discovered a spying campaign, likely linked to Russia, that targets organizations using Zimbra webmail (an email platform used by governments, militaries, transportation companies, and banks). The attackers send phishing emails containing hidden malicious code that runs automatically just by opening the email — the victim doesn't need to click anything. This code steals the victim's email password, security codes, and up to three months of their email and search history, sending it to servers controlled by the attackers. Organizations in NATO countries, Ukraine, nearby former-Soviet states, and Africa have been targeted since at least 2024, with this specific Zimbra-focused attack starting in July 2025. Organizations using Zimbra should apply available security patches immediately and check for signs of compromise using the indicators provided in this report.
Key Takeaways
- A Russian-nexus cyberespionage cluster tracked as CL-STA-1114 (overlapping with Void Blizzard/LAUNDRY BEAR) exploits CVE-2025-66376 in Zimbra Collaboration Suite via zero-click phishing emails requiring no recipient interaction.
- The exploit uses an obfuscated HTML/SVG onload technique to decode a Base64 JavaScript payload injected directly into the victim's browser session upon email rendering.
- Exfiltrated data includes CSRF tokens, webmail credentials, 2FA scratch codes, system/environment details, and up to 90 days of email and search history.
- The campaign has been active since at least 2024, with the Zimbra-focused activity starting July 2025, targeting government, defense, transportation, and financial sectors across NATO, Ukraine, CIS countries, and Africa.
- At least nine C2 IP addresses and nine domains have been identified, each active for an average of 35.4 days, indicating frequent infrastructure rotation.
Affected Systems
- Zimbra Collaboration Suite (ZCS) webmail platform - unpatched instances vulnerable to CVE-2025-66376
- Organizations in government, defense, transportation, and financial sectors
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2025-66376 | Zimbra Collaboration Suite (ZCS) | Allows automatic injection of malicious JavaScript into a victim's webmail session via a crafted phishing email without requiring any recipient interaction (zero-click), enabling exfiltration of credentials, 2FA scratch codes, and email data. |
Attack Chain
- Initial Access: Phishing email delivered with HTML attachment or embedded HTML using a news-headline lure to attract victim attention
- Zero-Click Exploitation: Loading the email/HTML triggers CVE-2025-66376, executing an obfuscated invisible SVG element embedded in the Zimbra webmail rendering
- Payload Execution: The SVG onload event decodes a Base64-encoded JavaScript payload and injects it into the victim's browser session, no user interaction required
- Data Collection: The injected JavaScript harvests CSRF tokens, credentials, 2FA scratch codes, system/environment details, and 90 days of email and search history
- Exfiltration: Collected data is sent to hardcoded C2 domains/IPs rotated across the campaign infrastructure
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not include YARA, Sigma, Snort/Suricata, KQL, SPL, or EQL detection rules. It references Palo Alto Networks commercial product protections (Cortex Advanced Email Security, Advanced WildFire, Advanced URL Filtering, Advanced DNS Security) that detect the associated malicious domains, URLs, and attachments, and provides a raw IOC list for manual detection/blocking.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The initial exploitation occurs client-side within the webmail rendering context (browser/webmail application), not through typical endpoint process execution, making it largely invisible to traditional EDR unless browser script execution or DOM-level telemetry is monitored. |
| Network Visibility | Medium | Outbound connections from the browser/webmail session to hardcoded C2 domains/IPs could be observed via proxy, DNS, or web traffic logs if organizations have visibility into webmail-originated outbound traffic. |
| Detection Difficulty | Hard | The zero-click nature, use of obfuscated SVG/onload JavaScript execution, and lack of user interaction make this difficult to detect without deep email content inspection or webmail application-layer monitoring; the vulnerability's exploitation occurs without any anomalous endpoint process behavior. |
Required Log Sources
- Email gateway/attachment scanning logs
- Web proxy / HTTP(S) traffic logs
- DNS query logs
- Zimbra server access and application logs
- Browser-based content security policy (CSP) violation reports, if configured
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for inbound emails containing obfuscated HTML/CSS constructs with hidden divs, invisible SVG elements, or Base64-encoded blobs embedded near @import or onload attributes, consistent with attempts to exploit T1190 in webmail platforms. | Email gateway content inspection logs, attachment/HTML scanning results | Initial Access / Exploitation | Medium - legitimate marketing emails and newsletters occasionally use obfuscated or minified CSS/HTML, requiring tuning to avoid noise |
| Monitor for outbound web/DNS requests from webmail server IP ranges or user browser sessions to newly registered or recently observed domains resembling Zimbra-branding or analytics-themed names (T1071.001). | DNS logs, proxy logs, TLS SNI records | Command and Control | Low - Zimbra-branded lookalike domains combined with newly observed domain age are relatively distinctive |
| Hunt for anomalous session activity on Zimbra webmail accounts, such as unexpected password resets, 2FA scratch code usage, or bulk mailbox search/export activity shortly after email delivery (T1114.002, T1539). | Zimbra application/audit logs, authentication logs | Collection / Credential Access | Medium - legitimate bulk searches or account recovery activity could trigger false positives |
| Identify repeated CSRF token exfiltration attempts by correlating unusual client-side script execution errors or CSP violations reported by browsers accessing webmail (T1539). | Browser CSP violation reports, web application firewall logs | Execution | Low - CSP violations tied to unexpected external domains are uncommon in normal operation |
Control Gaps
- Traditional signature-based antivirus and EDR are unlikely to detect browser-based JavaScript injection triggered by zero-click email rendering
- Standard email security gateways that only scan attachments for known malware signatures may miss obfuscated HTML/CSS-based exploitation
- Unpatched Zimbra instances remain vulnerable regardless of endpoint security posture since exploitation occurs at the application layer
Key Behavioral Indicators
- Presence of invisible/hidden SVG elements with onload event handlers embedded in email HTML content
- Base64-encoded script blobs embedded within obfuscated CSS @import or style attributes in email bodies
- Unusual outbound connections from webmail server infrastructure to newly registered analytics or Zimbra-themed domains
- Unexpected access to 2FA scratch codes or CSRF tokens shortly after email delivery to a mailbox
False Positive Assessment
Medium - the C2 domains use Zimbra/analytics-themed naming conventions that could partially overlap with legitimate analytics services, and obfuscated HTML/CSS techniques could occasionally appear in legitimate but poorly coded marketing emails, requiring careful validation before blocking.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting; prioritize patching all internet-facing Zimbra Collaboration Suite instances against CVE-2025-66376 if not already applied.
- Consider blocking or monitoring the IP addresses and domains listed in this report at your email gateway, proxy, and DNS security layers where applicable.
- If your incident response process supports it, review Zimbra audit and authentication logs for signs of anomalous access, credential use, or bulk mailbox exports coinciding with suspicious email delivery.
Infrastructure Hardening
- Evaluate whether your email security stack routes suspicious HTML attachments through sandboxing/dynamic analysis (e.g., a WildFire-equivalent capability) prior to delivery.
- Consider enforcing Content Security Policy (CSP) headers on webmail platforms to restrict inline script execution and reduce the impact of injected JavaScript.
- Where feasible, segment and monitor webmail server outbound traffic separately to detect anomalous C2-style connections.
- Assess whether multi-factor authentication and session token rotation policies are enforced for webmail accounts to limit the value of stolen credentials/2FA scratch codes.
User Protection
- If your endpoint or email security tooling supports HTML/SVG content inspection, consider enabling deeper inspection of email body content beyond attachment scanning.
- Evaluate whether your organization can enforce automatic patch deployment or virtual patching for Zimbra and similar webmail platforms.
- Consider implementing conditional access policies that flag or challenge logins following suspicious webmail session activity.
Security Awareness
- Consider incorporating awareness of zero-click phishing risks into existing security training, emphasizing that visible interaction (e.g., clicking links) is not always required for compromise.
- Encourage IT/security teams to maintain an inventory of internet-facing Zimbra and other webmail deployments to track patch status.
- Where applicable, share IOC lists with threat intelligence sharing communities or platforms your organization participates in to support broader detection.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping8 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- Ips:
104[.]248[.]134[.]194- C2 server IP associated with CL-STA-1114 campaign infrastructure185[.]86[.]79[.]95- C2 server IP associated with CL-STA-1114 campaign infrastructure193[.]238[.]152[.]66- C2 server IP associated with CL-STA-1114 campaign infrastructure194[.]156[.]103[.]193- C2 server IP associated with CL-STA-1114 campaign infrastructure216[.]252[.]238[.]18- C2 server IP associated with CL-STA-1114 campaign infrastructure216[.]252[.]238[.]64- C2 server IP associated with CL-STA-1114 campaign infrastructure216[.]252[.]238[.]104- C2 server IP associated with CL-STA-1114 campaign infrastructure
- Domains:
emailanalytics[.]com[.]ua- C2 domain used in CL-STA-1114 phishing/exfiltration infrastructureistc-cloud[.]com- C2 domain used in CL-STA-1114 phishing/exfiltration infrastructuremailnalysis[.]com- C2 domain used in CL-STA-1114 phishing/exfiltration infrastructuresynacorzimbra[.]nl- C2 domain masquerading as Zimbra/Synacor-related infrastructure
