11 minhigh
TA488 Targets Zimbra Mailservers with Half-Click Exploits
TA488, a Russia-aligned threat actor linked with medium confidence to Void Blizzard/Laundry Bear, exploited a zero-day flaw (CVE-2025-66376) in Zimbra's client-side HTML sanitizer using a tag-splitting technique with fake CSS @import directives to smuggle executable SVG/JavaScript payloads. The resulting malware, ZimReaper, requires only that a victim open/preview a crafted email in vulnerable Zimbra webmail to execute in the browser context, harvesting CSRF tokens, autofill credentials, and 2FA codes, establishing a persistent app-specific password bypassing MFA, and exfiltrating Global Address List data and up to 90 days of email via DNS tunneling and HTTP POST to Cloudflare-fronted C2 infrastructure. Targeting focused on Ukrainian government and US government/science/defense industrial base entities, with the campaign going dormant after public disclosure by Seqrite in early 2026.
Sens:■ Immediate
Showing defanged values
- domainanalyticemailmeter[.]comZimReaper C&C domain, first seen September 2025
- domainemailanalytics[.]com[.]uaZimReaper C&C domain, first seen September 2025
- domainistc-cloud[.]comZimReaper C&C domain, first seen February 2026
- domainmailnalysis[.]comZimReaper C&C domain, first seen November 2025
- domainsynacorzimbra[.]nlZimReaper C&C domain, first seen February 2026
- domainzimbra-metadata[.]comZimReaper C&C domain, first seen August 2025
- domainzimbrasoft[.]com[.]uaZimReaper C&C domain, first seen January 2026
- domainzimbrastat[.]comZimReaper C&C domain, first seen December 2025
- domainzmailanalytics[.]comZimReaper C&C domain used for beaconing and DNS/HTTPS exfiltration, first seen July 2025
- sha2561517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760Exploit email hash, November 2025
- sha25660db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874Exploit email hash, December 2025
- sha25698df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aafHash of exploit email delivering CVE-2025-66376 XSS payload, February 2026
- sha256b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1dExploit email hash, December 2025
- urlhxxps://js-zmb_pl_v3_[.]i[.]zmailanalytics[.]com/v/dZimReaper DNS-tunneling exfiltration subdomain path used for data exfiltration
- urlhxxps://js-zmb_pl_v3_[.]i[.]zmailanalytics[.]com/v/pZimReaper DNS-tunneling exfiltration subdomain path used for pixel/beacon logging
Detection / HunterAnthropic
What Happened
Security researchers found that a Russia-linked hacking group exploited a previously unknown flaw in Zimbra webmail software, which many governments and organizations use to send and receive email. The attack was unusually stealthy: victims only had to open or preview a malicious email in their webmail inbox—no clicking on links or attachments was needed—for the hackers' code to run and steal passwords, two-factor authentication codes, and copies of the victim's emails. This mainly affected government agencies in Ukraine, along with US government, scientific, and defense-related organizations. It matters because it shows attackers can compromise email accounts with almost no user action, undermining trust in webmail as a secure channel, and because the stolen access let hackers send further malicious emails from trusted, real accounts. Organizations using Zimbra should apply the vendor's patch for this flaw immediately, check their systems' logs for signs of unauthorized password creation, and review the detection rules the researchers published.
Key Takeaways
- TA488 (aka Void Blizzard/Laundry Bear) exploited a previously unknown zero-day (CVE-2025-66376) in Zimbra Collaboration Suite's client-side HTML sanitizer for at least five months in 2025.
- The exploit is a 'half-click' attack: opening or previewing the malicious email in vulnerable Zimbra webmail triggers stored XSS with no further user interaction required.
- The malware, dubbed ZimReaper, steals CSRF tokens, autofill passwords, and 2FA scratch codes, creates a persistent 'ZimbraWeb' app-specific password bypassing 2FA, and exfiltrates emails and Global Address List data via DNS tunneling and HTTP POST.
- TA488 used tag-splitting with fake CSS @import directives to evade Zimbra's sanitizer, and later added XOR obfuscation to evade secure email gateway detection.
- Targeting focused on Ukrainian government entities and US government, high science, and defense industrial base organizations; infrastructure used Cloudflare nameservers and spoofed Zimbra telemetry naming to blend in with legitimate traffic.
Affected Systems
- Zimbra Collaboration Suite webmail servers
- Government and education sector email users
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2025-66376 | Zimbra Collaboration Suite (client-side HTML sanitizer) | Improper sanitization of content between @import directives in Zimbra's HTML sanitizer allows attackers to smuggle executable SVG/script tags that trigger stored XSS when a malicious email is opened or previewed. |
Attack Chain
- Delivery: TA488 sends generic-lure emails from Proton Mail or compromised addresses to government/education targets.
- Exploitation: Opening/previewing the email in vulnerable Zimbra webmail triggers stored XSS (CVE-2025-66376) via tag-split SVG/onload/eval/atob construct hidden with fake CSS @import directives.
- Execution: First-stage JavaScript checks for prior execution, injects itself with ID zmb_pl_v3_, and XOR-decodes a second-stage payload (ZimReaper).
- Credential Theft & Reconnaissance: ZimReaper steals CSRF tokens, autofill passwords, and 2FA scratch codes; uses Zimbra APIs to gather device/account details.
- Persistence: Malware creates a persistent 'ZimbraWeb' app-specific password via CreateAppSpecificPasswordRequest, enabling IMAP/POP3/SMTP access without 2FA.
- Exfiltration: Stolen data (2FA codes, passwords, GAL contacts, up to 90 days of email as TGZ) exfiltrated via DNS queries (Base32-encoded) and HTTP POST to Cloudflare-fronted C2 domains; compromised mailboxes reused to send further exploit emails.
Detection Availability
- YARA Rules: Yes
- Sigma Rules: No
- Snort/Suricata Rules: Yes
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Emerging Threats (ET/ETPRO), Proofpoint YARA rules
The article references specific ET and ETPRO Suricata/Snort rule IDs (e.g., ZimReaper C2 Beacon, Exfiltration, Mailbox Archive Export, DNS-label exfiltration, GAL Bulk Enumeration, and the CVE-2025-66376 sanitization bypass rule) as well as a named YARA rule for tracking TA488 exploit emails, though rule bodies are withheld from this report per handling policy.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Execution occurs within the browser's JavaScript engine during an authenticated webmail session, which typically leaves minimal forensic trail for endpoint EDR or antivirus tooling, per the article's own assessment. |
| Network Visibility | Medium | DNS tunneling exfiltration and HTTP POST to C2 domains could be visible via DNS logging, TLS SNI inspection, or secure email gateway analysis, though attacker use of Cloudflare nameservers and spoofed 'analytics/telemetry' domain naming is designed to blend with legitimate traffic. |
| Detection Difficulty | Hard | The exploit uses tag-splitting to evade the mail server's own HTML sanitizer, layered XOR obfuscation to evade gateway detection, and executes entirely client-side in-browser, requiring correlation across mail server logs, DNS telemetry, and network traffic rather than a single signature. |
Required Log Sources
- Zimbra audit.log (CreateAppSpecificPassword events)
- DNS query logs
- TLS SNI/certificate logs
- Secure email gateway logs
- HTTP/S proxy logs
- Zimbra SOAP API access logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for creation of new app-specific passwords in Zimbra mailserver logs, particularly named similarly to legitimate client names, which may indicate persistence establishment following exploitation. | Zimbra audit.log entries for CreateAppSpecificPasswordRequest calls | Persistence (T1098/T1556) | Low-Medium; legitimate users occasionally create app-specific passwords for third-party mail clients, so context (naming, timing, source IP) should be reviewed. |
| Hunt for outbound DNS queries containing long Base32-encoded subdomain labels directed at newly registered domains styled as analytics/telemetry/metadata services. | DNS query logs, passive DNS, newly observed domain registrations | Exfiltration (T1048/T1071.004) | Medium; legitimate analytics or CDN services can also use long subdomain structures, requiring domain reputation and registration age correlation. |
| Search inbound email content for HTML bodies containing repeated fragmented CSS @import directives interspersed within otherwise hidden div/style elements, which may indicate tag-splitting XSS attempts. | Secure email gateway content inspection, mail body HTML parsing logs | Initial Access/Exploitation (T1189) | Low; this fragmentation pattern is unusual in legitimate email and unlikely to occur benignly. |
| Monitor for bulk two-character-combination search queries against the Global Address List via Zimbra SOAP API, indicative of automated directory harvesting. | Zimbra SOAP/API access logs (SearchGalRequest) | Discovery (T1087.003) | Low; this query pattern is atypical of normal user or admin behavior. |
| Review large or repeated TGZ export requests from Zimbra mailbox export functionality outside normal admin/backup workflows. | Zimbra web server access logs for /home/~/?fmt=tgz requests | Collection/Exfiltration (T1114.002) | Low-Medium; legitimate backup or migration tools may also use export functionality. |
Control Gaps
- Traditional secure email gateway signature detection may be bypassed by tag-splitting and layered obfuscation techniques designed specifically to evade content inspection.
- Endpoint EDR/AV tools have limited visibility into in-browser JavaScript execution within an authenticated webmail session.
- Standard MFA enforcement can be bypassed once an app-specific password is created, since these credentials typically do not require 2FA for IMAP/POP3/SMTP access.
- DNS-based exfiltration using legitimate-looking analytics/telemetry domain names may evade network anomaly detection that relies on domain reputation alone.
Key Behavioral Indicators
- Creation of new app-specific passwords with unusual or client-mimicking names shortly after receipt of an unsolicited email
- Browser JavaScript execution injecting DOM elements with the identifier pattern zmb_pl_v3_ or similar version-tagged script IDs
- Outbound queries to newly registered domains styled as email/webmail analytics or metadata services
- Sequential two-character Global Address List enumeration queries via webmail API
- Bulk TGZ mailbox export requests outside normal backup schedules
False Positive Assessment
Medium - Some hunting indicators (app-specific password creation, GAL enumeration, mailbox export requests) can overlap with legitimate administrative or user activity, requiring contextual correlation (naming conventions, timing, source, volume) to reduce false positives; however, the specific tag-splitting XSS pattern and zmb_pl_v3_ script identifiers are highly distinctive and unlikely to occur benignly.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting: if running Zimbra Collaboration Suite, confirm the patch for CVE-2025-66376 has been applied and prioritize emergency patching if not.
- Review /opt/zimbra/log/audit.log for CreateAppSpecificPassword calls and revoke/remediate any suspicious app-specific passwords, particularly those named 'ZimbraWeb' or similar.
- Consider forcing password resets and re-enrollment in 2FA for any mailbox accounts suspected of compromise.
- If your secure email gateway supports custom rule deployment, consider ingesting the referenced ET/ETPRO Suricata rules and YARA rule to detect known ZimReaper indicators.
Infrastructure Hardening
- Evaluate whether outbound DNS traffic can be restricted or monitored for anomalous long-label queries indicative of DNS tunneling.
- Consider implementing DNS logging and alerting on queries to newly registered domains, especially those resembling analytics/telemetry/metadata naming conventions.
- Where supported, restrict or closely monitor Zimbra API endpoints (e.g., SOAP GAL search, mailbox export) for anomalous bulk usage patterns.
- Evaluate network segmentation to limit direct internet egress from mail server infrastructure where feasible.
User Protection
- If your EDR or browser security tooling supports it, consider monitoring for anomalous in-browser script injection within webmail sessions.
- Encourage disabling browser autofill for webmail credentials where organizational policy allows, given the observed autofill password harvesting technique.
- Consider enforcing hardware-based or app-based MFA methods less susceptible to app-specific password bypass, if supported by your Zimbra deployment.
Security Awareness
- Update security awareness training to note that some webmail exploits require no click or attachment interaction, and reinforce reporting of suspicious or unexpected emails even when no action was taken.
- Brief IT/security teams on the specific persistence technique of app-specific password abuse so it can be recognized during account audits.
- Share threat intelligence on TA488/ZimReaper with peer organizations in government, education, and defense sectors given the observed sector targeting.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Urls:
hxxps://js-zmb_pl_v3_[.]i[.]zmailanalytics[.]com/v/p- ZimReaper DNS-tunneling exfiltration subdomain path used for pixel/beacon logginghxxps://js-zmb_pl_v3_[.]i[.]zmailanalytics[.]com/v/d- ZimReaper DNS-tunneling exfiltration subdomain path used for data exfiltration
- File Hashes:
98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf(SHA256) - Exploit email hash, February 202660db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874(SHA256) - Exploit email hash, December 2025b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d(SHA256) - Exploit email hash, December 20251517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760(SHA256) - Exploit email hash, November 2025
- File Paths:
/opt/zimbra/log/audit.log- Zimbra audit log recommended for review to detect CreateAppSpecificPassword calls indicating compromise
- Other:
[email protected]- Actor-controlled Proton Mail sender address used to deliver exploit emails, first seen September 2025[email protected]- Actor-controlled Proton Mail sender address used to deliver exploit emails, first seen October 2025[email protected]- Actor-controlled Proton Mail sender address used to deliver exploit emails, first seen November 2025ZimbraWeb- Name given to malicious app-specific password created via CreateAppSpecificPasswordRequest for persistent mailbox access bypassing 2FA