Full Report
Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency Contents Introduction Target Phishing Email Infection Analysis Stage-1: JavaScript Loader Stage-2: Browser Stealer Infrastructure and Attribution CVE Assessment Conclusion Seqrite Coverage IOCs MITRE ATT&CK Introduction Seqrite Labs identified a targeted phishing campaign that exploits a cross-site scripting (XSS) vulnerability in Zimbra Collaboration (ZCS) […] The post Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency appeared first on Blogs on Information Technology, Network & Cybersecurity | Seqrite.
Analysis Summary
# Incident Report: Operation GhostMail (Russian APT Exploitation of Zimbra)
## Executive Summary
A Russian state-sponsored APT targeted a Ukrainian government entity (Hydrology Agency) using a zero-click stored Cross-Site Scripting (XSS) vulnerability in the Zimbra Collaboration Suite. The campaign utilized a sophisticated, obfuscated JavaScript payload embedded directly in a phishing email body to exfiltrate 90 days of mailbox content, session tokens, and 2FA backup codes. The attack is significant for its lack of traditional indicators like malicious attachments or external links, operating entirely within the browser context.
## Incident Details
- **Discovery Date:** February 26, 2026 (Initial VirusTotal upload)
- **Incident Date:** January 22, 2026
- **Affected Organization:** Ukrainian State Hydrology Agency
- **Sector:** Government / Critical National Infrastructure
- **Geography:** Ukraine
## Timeline of Events
### Initial Access
- **Date/Time:** January 22, 2026
- **Vector:** Phishing email exploiting CVE-2025-66376.
- **Details:** A social-engineered internship inquiry was sent from a likely compromised account at the National Academy of Internal Affairs (NAVS). The email contained no links or attachments but featured a hidden Base64-encoded JavaScript payload designed to bypass Zimbra’s AntiSamy HTML sanitization.
### Lateral Movement
- **Details:** The attack focused on session hijacking and credential theft within the webmail environment. Once the XSS triggered, the script used `window.top.document` iframe escapes to gain control over the full Zimbra web interface.
### Data Exfiltration/Impact
- **Details:** The primary impact was the systematic theft of the victim's mailbox (90-day sweep). Attackers also targeted "App-Specific Passwords" to maintain long-term access and stole 2FA "scratch codes" (backup codes) to bypass future multi-factor authentication.
### Detection & Response
- **How it was discovered:** Seqrite Labs identified the campaign via telemetry and a February 2026 VirusTotal upload.
- **Response actions taken:** The incident was reported to CERT-UA for remediation and government-wide alerting.
## Attack Methodology
- **Initial Access:** Stored XSS via crafted `@import` directives in HTML email (CVE-2025-66376).
- **Persistence:** Minting new credentials via `CreateAppSpecificPasswordRequest`.
- **Privilege Escalation:** Not applicable (Cloud/Web session hijacking).
- **Defense Evasion:** Use of XOR + Base64 encoding; Fragmented token noise to bypass regex-based security filters.
- **Credential Access:** Theft of CSRF tokens, session cookies, 2FA backup codes, and browser autocomplete data.
- **Discovery:** System fingerprinting via `GetInfoRequest` and account discovery via `GetIdentitiesRequest`.
- **Lateral Movement:** Web-based session hijacking.
- **Collection:** Retrieval of 90 days of emails and `zimbra_batch_analytics.json` configuration dumps.
- **Exfiltration:** Data sent via HTTPS POST requests and Base32-encoded DNS tunneling.
- **Impact:** Complete compromise of sensitive maritime/infrastructure communications.
## Impact Assessment
- **Financial:** Unknown; operational costs related to incident response.
- **Data Breach:** Extensive; 90 days of government email history and authentication secrets.
- **Operational:** Potential disruption to the State Service for Maritime and River Transportation.
- **Reputational:** High-profile targeting of critical national infrastructure.
## Indicators of Compromise
- **Network indicators:**
- hxxps[://]i.zimbrasoft[.]com[.]ua/v/d
- hxxps[://]i.zimbrasoft[.]com[.]ua/v/p
- [a-z0-9]{12}.i.zimbrasoft[.]com[.]ua (DNS Exfiltration)
- **File indicators:** `zimbra_batch_analytics.json` (Targeted for exfiltration).
- **Behavioral indicators:** Unusual Zimbra SOAP API requests (`GetScratchCodesRequest`, `CreateAppSpecificPasswordRequest`) originating from the client browser session rather than standard user actions.
## Response Actions
- **Containment:** Blocked identified C2 domains at the gateway level.
- **Eradication:** Patched Zimbra Collaboration Suite to version 10.0.18 / 10.1.13 or higher.
- **Recovery:** Revoked all active session tokens and secondary "App-Specific" passwords for affected users.
## Lessons Learned
- **Bypassing Sanitization:** Attackers are finding creative ways to bypass standard HTML sanitizers (like AntiSamy) using fragmented tag names.
- **"Attachmentless" Phishing:** Modern email security must move beyond link/file scanning to include sophisticated analysis of the HTML body content itself.
- **Cloud Persistence:** Monitoring for the creation of new application-specific passwords is a critical but often overlooked defensive metric.
## Recommendations
1. **Immediate Patching:** Ensure Zimbra instances are updated to the latest versions to remediate CVE-2025-66376.
2. **Hardened Webmail Policies:** Disable the "Classic UI" if not required, as the vulnerability specifically affects this interface.
3. **Log Monitoring:** Implement SIEM alerts for administrative SOAP requests (like `GetScratchCodes`) triggered from the end-user WebClient.
4. **Email Gateway:** Deploy advanced email security solutions capable of de-obfuscating embedded JavaScript within the message body.