What Changed
A joint NSA and CISA advisory, backed by research from Palo Alto Networks Unit 42 and Proofpoint, details a Russian espionage campaign that exploited CVE-2025-66376 in Zimbra Collaboration to steal mail. The flaw is a stored cross-site scripting bug in the Classic web UI, triggered through CSS @import. NVD scores it 6.1 while MITRE rates it 7.2.
Unit 42 tracks the activity as CL-STA-1114 and Proofpoint as TA488; the activity overlaps with names such as LAUNDRY BEAR and Void Blizzard. The operation has been running since at least July 2025, uses a payload called ZimReaper, and relied on at least nine command-and-control IPs and domains.
Why This Is An Operations Problem
The bug was fixed on November 6, 2025 (Zimbra 10.0.18 and 10.1.13) and has been in CISA’s KEV catalog since March 18, 2026. The persistence technique is the bigger issue: attackers created an app-specific password named “ZimbraWeb” and enabled IMAP, which keeps mailbox access alive after a patch or password reset.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Zimbra 10.0 reached end of life on December 31, 2025, so organizations still on that branch need a migration plan, not just a hotfix. The current 10.1 release, 10.1.20, shipped on July 20.
What To Verify First
- Confirm all Zimbra servers run a supported, patched 10.1 build.
- Search
audit.logforCreateAppSpecificPassword, changes tozimbraPrefImapEnabledandGetScratchCodesRequest. - Review accounts for app-specific passwords named “ZimbraWeb” and revoke anything unexpected.
- Block and hunt for the advisory’s published C2 indicators.
What Teams May Be Underestimating
Email espionage is quiet. A compromise that began in 2025 may still be active through app passwords and IMAP access, so treat log review as mandatory even on patched servers.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
