Unit 42 details CL-STA-1114, a Russian-nexus cyberespionage campaign overlapping with Void Blizzard/LAUNDRY BEAR, exploiting CVE-2025-66376 in Zimbra webmail through zero-click phishing emails containing obfuscated HTML/SVG that decodes and executes a Base64-encoded JavaScript payload in the victim's browser. The payload exfiltrates CSRF tokens, credentials, 2FA scratch codes, and up to 90 days of email/search history to hardcoded C2 servers, with at least nine IPs and nine domains identified as rotating infrastructure averaging 35.4 days of activity.
Zero-Click Phishing
1 post
Russian Global Webmail Espionage