Full Report
A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor recovery. Opening the message was enough to start it. The NSA, CISA and partner agencies published
Analysis Summary
Based on the article provided, here is a structured summary of the threat actor and their recent activities.
# Threat Actor: TA488 / CL-STA-1114
## Attribution & Identity
* **Actor Name/Aliases:** TA488 (tracked by Proofpoint), CL-STA-1114 (tracked by Unit 42).
* **Affiliation:** Described as a Russian state-supported espionage group.
* **Known Associations:** Identified in a joint advisory involving the NSA, CISA, and international partner agencies.
## Activity Summary
The group conducted a prolonged espionage campaign starting at least as early as July 2025. They specialized in exploiting a zero-day vulnerability in the Zimbra Collaboration suite to gain unauthorized access to the mailboxes of high-value targets. The campaign remained active for at least five months before a patch was issued and adopted.
## Tactics, Techniques & Procedures
* **Exploitation:** Leveraged a zero-click (or "view-based") stored cross-site scripting (XSS) vulnerability (**CVE-2025-66376**) in the Zimbra Classic UI.
* **Tag-Splitting:** Used a technique to bypass security sanitizers by breaking down malicious JavaScript tags using CSS `@import` directives and HTML comments.
* **Authentication Bypass:** Generated app-specific passwords (`ZimbraWeb`) to maintain persistent IMAP/POP3/SMTP access that bypasses two-factor authentication (2FA).
* **Data Collection:** Specifically targeted the last 90 days of emails, global address lists (via brute-forcing the Global Address List API), and 2FA recovery codes.
* **Exfiltration:** Used DNS queries to exfiltrate stolen credentials and token data; used TGZ archives to post stolen mail to Command and Control (C2) servers.
**MITRE ATT&CK IDs (Associated):**
* T1189 (Drive-by Compromise)
* T1555 (Credentials from Password Stores)
* T1114 (Email Collection)
* T1071.004 (Application Layer Protocol: DNS)
## Targeting
* **Sectors:** Government, Defense, Scientific, Defense Industrial Base (DIB), Transportation, Financial, and Nuclear installations.
* **Geography:** NATO member states, United States, Ukraine, Commonwealth of Independent States (CIS), and Africa.
* **Victims:** Specific organizations were not named, but included "Western government and commercial organizations."
## Tools & Infrastructure
* **Malware Families:** **ZimReaper** (JavaScript payload used for credential and token theft).
* **Delivery Infrastructure:** Compromised third-party email addresses and actor-controlled Proton Mail accounts.
* **C2 Infrastructure:** Unit 42 identified nine C2 IP addresses and nine domains (which typically remained active for approximately 35 days).
* *Note: Specific IPs/URLs were not listed in the text provided but would typically be defanged as `192[.]168[.]1[.]1`.*
## Implications
This campaign demonstrates a high level of technical sophistication in exploiting webmail sanitization weaknesses. By targeting the underlying mail platform rather than the endpoint, the actor successfully bypassed modern defenses like 2FA. The long-term retention of stolen credentials and the creation of app-specific passwords mean that victims may remain compromised even after patching the primary vulnerability.
## Mitigations
* **Patch Management:** Immediately update Zimbra Collaboration to version `10.0.18`, `10.1.13`, or higher to close CVE-2025-66376.
* **Credential Reset:** Because the exploit steals passwords and creates persistent application tokens, organizations must rotate all user credentials and revoke all "App-Specific Passwords" after patching.
* **Session Management:** Invalidate all active webmail sessions to clear potentially stolen CSRF tokens.
* **API Monitoring:** Monitor Zimbra logs for unusual `CreateAppSpecificPasswordRequest` calls or bulk Global Address List (GAL) queries.
* **Network Defense:** Screen for unusual DNS query volume which may indicate data exfiltration via the ZimReaper payload.