Russian Espionage Group Exploited Zimbra Zero-Day to Steal Emails and 2FA Codes
A state-backed group leveraged a flaw in Zimbra's webmail client for data theft.
1Introduction
A Russian state-backed cyber espionage group exploited a zero-day vulnerability in Zimbra's webmail client to infiltrate email accounts of Western government and commercial organizations. The flaw triggered simply by viewing an email, stealing the last 90 days of emails, directory data, and 2FA codes.
2Vulnerability Details
The flaw, CVE-2025-66376, was a stored cross-site scripting (XSS) vulnerability in Zimbra's Classic UI. A malicious HTML email abused CSS @import handling to execute JavaScript, hijacking the user's session and gaining mailbox access.
3Targeted Sectors
The campaign targeted government, defense, transportation, and financial organizations in NATO member states, Ukraine, the Commonwealth of Independent States, and Africa. U.S. defense industrial base entities, including nuclear facilities, were also on the list.
4Data Exfiltration Method
The JavaScript payload, dubbed ZimReaper, stole CSRF tokens, browser-saved passwords, and 2FA codes. It brute-forced the Global Address List and exfiltrated 90 days of victim emails as a TGZ archive to command-and-control servers.
5Mitigation and Patch
Zimbra patched the flaw in November 2025, but the update didn't revoke stolen credentials. Organizations must reset passwords, terminate active sessions, and regenerate 2FA codes. Accounts with IMAP access should be reviewed for unauthorized activity.
6Conclusion and Warning
Experts warn that such attacks will continue, with other Western email systems potentially at risk. Organizations must apply patches and enhance security measures to protect against similar threats in the future.