Russian Global Webmail Espionage
Summary: Unit 42 is tracking a persistent cyberespionage campaign, CL-STA-1114, overlapping with a Russian threat actor tracked by other vendors as Void Blizzard and LAUNDRY BEAR, that targets Zimbra webmail using zero-click phishing emails exploiting CVE-2025-66376. The exploit injects a malicious JavaScript payload without recipient interaction that exfiltrates login credentials, email archives, and search histories to hard-coded command and control servers, with the campaign active since at least 2024 and targeting Zimbra servers since July 2025.
What's compelling: The group has used at least nine IP addresses and nine domains for its C2 servers, active for an average of 35.4 days each, and continues to target unpatched ZCS instances - so an unpatched Zimbra server is an open door to credential and mailbox theft with no user click required.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-66376
- Related
- CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Known Exploited Vulnerabilities · Mar 18, 2026