Russian Hackers Breach Zimbra Collaboration Suite

A Russian hacking group known as Laundry Bear has exploited a vulnerability in the Zimbra Collaboration Suite (ZCS), allowing them to target organizations using this platform.

America’s Cyber Defense Agency, CISA, has published an advisory warning that this is a state-sponsored attack targeting several Western government and commercial organizations using Zimbra Collaboration Suite (ZCS).

Based on this report, Laundry Bear leveraged a zero-day vulnerability that was patched in November 2025, demonstrating the group’s sophisticated techniques.

The technique used in this attack is not a conventional phishing campaign that manipulates the user into clicking a link or downloading an attachment. Instead, Laundry Bear leveraged a “half-click” or view-based exploit, which only requires the targeted user to view or preview the malicious email from within a vulnerable version of this software. This exploit attempts to exfiltrate the last 90 days of email communication, the organizational directory, and other sensitive information. This makes it a significantly dangerous threat, as a single successful attempt grants the attacker access to a vast amount of sensitive data.

This advisory also warns that this is an ongoing threat activity and urges organizations using ZCS to update the software and implement additional necessary mitigations.

CISA Recommended Mitigation Strategies:

• Patch Immediately: Update Zimbra Collaboration Suite (ZCS) to versions 10.1.13 or 10.0.18 to fix the CVE-2025-66376 vulnerability.
• Use Alternative Clients: If you cannot patch right away, instruct employees to avoid Classic ZCS webmail and use alternative email clients instead.
• Strengthen Authentication: Implement third-party services that support passkeys to protect against automated password collection, and closely monitor any Application Passcodes.
• Monitor Network Traffic: Collect and review packet capture/NetFlow data to spot suspicious activity, such as large data transfers to unknown VPS providers, strange DNS queries, or internal logins from VPNs like Mullvad.
• Inspect HTTPS Traffic: If you have break-and-inspect capabilities, actively look for characteristics of data exfiltration in outbound HTTPS connections.

Proofpoint, a market leader in email security, has published a detailed report on how this attacker leveraged the half-click exploit.

Proofpoint identifies the hacking group as TA488 (formerly UNK_PitStop) in its report. TA488 is widely believed to be an industry alias for the same Russian state-aligned hackers. The group is also tracked as Void Blizzard (by Microsoft) and CL-STA-1114 (by Palo Alto Networks’ Unit 42).

Below is an example of an email sent by this group. All the attacker has to do is lure the user to open or preview it. The XSS exploit is embedded directly in the HTML body of the message and fires as soon as the victim opens or previews it in the vulnerable Zimbra webmail client.

Source: Proofpoint

Once opened in the vulnerable Zimbra webmail, the client mishandles the HTML and runs arbitrary JavaScript. The primary vulnerability is a lack of adequate sanitization in Zimbra’s client-side HTML sanitizer.

The attacker hides a malicious svg tag, which the sanitizer fails to recognize as executable markup, allowing the browser to successfully reconstruct and execute it.

Source: Proofpoint

Message body HTML showing the stored XSS and encoded JavaScript.

References:

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
• https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits