Russia Exploits Zimbra Zero-Day: Patching Alone Won't Evict the…

A zero-click XSS flaw in Zimbra Collaboration Suite let a Russian espionage group harvest emails, 2FA codes, and persistent app passwords for over five months. The November 2025 patch fixes the vulnerability but does not revoke the attacker-created credentials, leaving patched organizations still exposed.

On July 23, 2026, intelligence agencies from fifteen nations disclosed what some victims still do not know: a zero-day vulnerability in Zimbra Collaboration Suite allowed a Russian espionage group to collect emails, 2FA codes, and persistent passwords for more than five months, from July through November 2025. The software fix, released on November 6, 2025, does not automatically remove the access gained. Organizations that patched without checking for compromised app-specific passwords still have an open door for the attacker.

Key Takeaways

The group LAUNDRY BEAR — also tracked as Void Blizzard, CL-STA-1114, and TA488 — exploited CVE-2025-66376 without requiring any victim interaction: simply previewing the email triggers the payload.
Targets include NATO governments, the defense sector, transportation, finance, and Ukrainian institutions; the motive is exclusively state espionage, with no detected financial extortion.
The payload steals 90 days of email history, 2FA scratch codes, and creates an app-specific password named "ZimbraWeb" that persists even after the primary password is reset.
The "Flowerbed" command-and-control infrastructure — nine IP addresses and nine domains with an average lifespan of roughly 35.4 days — uses Docker containers and Let's Encrypt certificates for exfiltration via DNS and HTTPS.

How the Zero-Click Exploit Works in the Classic UI

The mechanism exploits a stored XSS in Zimbra's classic web interface. The malicious message contains a fragmented JavaScript payload inside bogus CSS @import directives and HTML comments. Zimbra's sanitizer strips the @import sequences, but the remaining characters are reassembled by the browser into executable code. The payload inherits the authenticated session context and invokes Zimbra's SOAP APIs to extract data and establish persistence.

According to Palo Alto Networks Unit 42 analysis, the group delivered "zero-click" phishing emails that automatically inject the JavaScript payload without recipient interaction. Proofpoint, reported by HackRead, confirms that "the XSS exploit is embedded directly in the HTML body of the message and activates as soon as the victim opens or previews it in the vulnerable Zimbra webmail client. No further user interaction is required."

The technical detail is consistent across independent sources. CISA, NSA, FBI, and allied agencies describe the campaign as "view-based": unlike traditional phishing, the user does not need to click a link or open an attachment. Merely viewing the message in the vulnerable webmail service is enough.

"Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR's latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service"
— NSA/CISA/FBI, joint advisory AA26-204A

The Theft That Survives: 2FA, App Passwords, and Persistence

Once executed, the payload — dubbed ZimReaper in early stages and Ulej in later variants — operated systematically. Converging sources document the extraction of the last 90 days of email communications, the Global Address List, browser-saved passwords, and 2FA scratch codes. Simultaneously, the payload generated an app-specific password labeled "ZimbraWeb" via the CreateAppSpecificPasswordRequest API call.

This last element turns a patchable vulnerability into an incident-response problem. According to Seqrite researchers cited by The Hacker News, "application-specific passwords survive password resets." The update to ZCS 10.0.18 or 10.1.13, released on November 6, 2025, fixes the flaw but does not automatically invalidate already-created app credentials. An organization that patched promptly without auditing app-specific passwords potentially keeps the attacker's access active.

The addition of CVE-2025-66376 to CISA's KEV catalog on March 18, 2026, mandates binding action for U.S. federal agencies and critical infrastructure contractors under Binding Operational Directive 22-01, with a deadline of April 1, 2026.

Attribution, Names, and Uncertainties

Attribution to the Russian government is shared by fifteen nations with "high confidence," per the joint advisory text. The group is known by multiple nomenclatures: LAUNDRY BEAR for AIVD and MIVD (Dutch intelligence services), Void Blizzard for Microsoft, CL-STA-1114 for Palo Alto Networks Unit 42, and TA488 for Proofpoint. The dossier does not establish whether the exploit was developed internally by the group or received from Russian intelligence services.

The motive is described in the advisory text with clarity: "The covert and persistent nature of this activity, combined with the absence of any known financial extortion, almost certainly indicates this group's involvement in espionage activities with the backing of the Russian government." The stated objective of the operations is intelligence collection on NATO governments, the defense industrial base, military support to Ukraine, and targets in Africa and CIS countries.

On the current operational front, documented uncertainties remain. Proofpoint has not detected TA488 activity since February 2026. Unit 42 reports continued exploitation of unpatched instances by unspecified actors, without confirming it is the same group. The dossier does not clarify whether credentials stolen in this campaign have been reused in subsequent intrusions beyond email access.

Technical Discrepancies: The CVSS and the Interaction Bit

A documented point of disagreement warrants attention. The National Vulnerability Database assigns CVE-2025-66376 a CVSS score of 6.1 with the UI:R (User Interaction Required) bit, indicating the user must take an action. The MITRE record on cve.org instead assigns CVSS 7.2 with UI:N (No User Interaction), consistent with the zero-click characterization of technical sources and the government advisory. Unit 42 and Proofpoint analysts maintain the zero-click definition regardless of the discrepancy in the NVD vector.

Immediate Actions

Check for anomalous app-specific passwords named "ZimbraWeb" or similar in the Zimbra environment; remove them and invalidate all active sessions, not just reset the primary password.
Verify unauthorized IMAP enablement for accounts that do not normally use it, as the Ulej payload demonstrably forced protocol activation for persistent access.
Audit sessions and SOAP API logs for CreateAppSpecificPasswordRequest calls during the July 2025 – February 2026 window, the confirmed activity interval.
Update to patched versions — 10.0.18 or 10.1.13 — if not already done, with the understanding that the patch prevents new access but does not remove established access.

Why the Response Cannot Stop at the Patch

This case exemplifies a threat category that makes the "patch and forget" criterion obsolete. When a webmail exploit acts at the moment of viewing and generates persistent credentials independent of the primary password, the response surface shifts from infrastructure to identity. Organizations must assume the update is necessary but not sufficient: rebuilding security posture requires mapping artifacts generated during compromise, not just closing the original flaw.

The LAUNDRY BEAR campaign also demonstrates that the objective of advanced espionage actors is no longer necessarily long-term persistence on the same infrastructure, but efficient collection of credentials and data via ephemeral infrastructure. The Flowerbed servers, with an average lifespan of just over a month, are designed to disappear before forensic analysis reaches them. Against this model, response speed matters more than preventive defense perfection.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references