# Russian Espionage Group Exploited Zimbra Zero-Day to Steal Emails and 2FA Codes A state-backed group leveraged a flaw in Zimbra's webmail client for data theft. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-23 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/771a0180-7ed3-431c-a8d2-b8b21e0d54cb ## Introduction A Russian state-backed cyber espionage group exploited a zero-day vulnerability in Zimbra's webmail client to infiltrate email accounts of Western government and commercial organizations. The flaw triggered simply by viewing an email, stealing the last 90 days of emails, directory data, and 2FA codes. ## Vulnerability Details The flaw, CVE-2025-66376, was a stored cross-site scripting (XSS) vulnerability in Zimbra's Classic UI. A malicious HTML email abused CSS @import handling to execute JavaScript, hijacking the user's session and gaining mailbox access. ## Targeted Sectors The campaign targeted government, defense, transportation, and financial organizations in NATO member states, Ukraine, the Commonwealth of Independent States, and Africa. U.S. defense industrial base entities, including nuclear facilities, were also on the list. ## Data Exfiltration Method The JavaScript payload, dubbed ZimReaper, stole CSRF tokens, browser-saved passwords, and 2FA codes. It brute-forced the Global Address List and exfiltrated 90 days of victim emails as a TGZ archive to command-and-control servers. ## Mitigation and Patch Zimbra patched the flaw in November 2025, but the update didn't revoke stolen credentials. Organizations must reset passwords, terminate active sessions, and regenerate 2FA codes. Accounts with IMAP access should be reviewed for unauthorized activity. ## Conclusion and Warning Experts warn that such attacks will continue, with other Western email systems potentially at risk. Organizations must apply patches and enhance security measures to protect against similar threats in the future. ## Sources covering this story - https://thehackernews.com/2026/07/russian-espionage-group-exploited.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._