The Zimbra Patch Is the Easy Part — Go Read Your Audit Log

If you run Zimbra Collaboration and you've been putting off the 10.1 upgrade, the joint advisory from NSA, CISA and partners this week should end that debate. A Russian state-backed group — tracked variously as TA488, CL-STA-1114, and mapped loosely to LAUNDRY BEAR and Void Blizzard — spent roughly five months of 2025 reading Western mailboxes through CVE-2025-66376, a stored XSS bug in the Classic Web Client that Zimbra didn't fix until 6 November 2025. As reported by The Hacker News and corroborated by BleepingComputer, the whole thing fired when a user viewed the message. No click, no attachment, no download.

Why this one is nastier than the usual XSS

Zimbra webmail XSS is not new — the Classic UI has been a repeat offender, and Zimbra just shipped four more stored XSS fixes in 10.1.20 on 20 July. What makes this campaign worth stopping your Monday for is not the delivery, it's what the payload did once JavaScript ran inside an authenticated session.

Proofpoint calls the payload ZimReaper. Per The Hacker News' breakdown of the Unit 42 and Proofpoint research, it lifted the CSRF token and the browser-autofilled password, pulled 2FA scratch codes and the Zimbra version through the platform's own SOAP APIs, brute-forced the entire Global Address List two characters at a time, and shipped 90 days of mail out as a TGZ — exfiltrating over DNS queries so it never needed an obvious outbound channel.

Then it did the thing that actually matters for your incident response: it created an app-specific password named ZimbraWeb via CreateAppSpecificPasswordRequest. That credential grants IMAP, POP3 or SMTP access without two-factor authentication. In the Ukrainian case Seqrite analysed, the payload also flipped zimbraPrefImapEnabled to TRUE. As the researchers put it, "app-specific passwords survive password resets."

The version bump does not clean the account

This is the sentence I want you to sit with: patching closes the hole, not the account. If a mailbox on your server viewed one of these emails in a vulnerable Classic UI session, upgrading to 10.1.13 or later does nothing to the credential the attacker already minted. You can patch a fully compromised server and hand the operator continued IMAP access with a straight face.

So do both jobs, in order. First the floor: 10.0 reached end of life on 31 December 2025, so 10.0.18 is an emergency stopgap, not a resting place — plan the move to a supported 10.1 build, and get 10.1 deployments to at least 10.1.13. CISA added this CVE to the Known Exploited Vulnerabilities catalog on 18 March 2026, so if you answer to that timeline, the clock is already loud.

Then work the accounts, because the update runs none of these checks for you. The guidance from Proofpoint and Seqrite, as relayed by The Hacker News, points at four concrete things worth your time:

• Comb /opt/zimbra/log/audit.log for CreateAppSpecificPassword calls and delete any credential named ZimbraWeb.
• Find accounts with zimbraPrefImapEnabled set to TRUE that have no business reason to speak IMAP, and ask why.
• Alert on SOAP calls to GetScratchCodesRequest — in normal operation that should be close to never.
• Watch DNS for the published C2 domains and for long random subdomain lookups, the signature of the exfil channel.

For any mailbox that opened or previewed a matching message, treat it as compromised: reset the password, kill active sessions, regenerate the 2FA scratch codes — and then check for the app password anyway, because that's the one a password reset won't touch.

What the sources can't tell you

Whether this campaign is still live is genuinely unsettled. Unit 42 says actors keep hitting unpatched ZCS; Proofpoint says it's seen nothing from TA488 since February 2026. Neither settles it, and it doesn't change your job — the CVSS scorers can't even agree whether "viewing" counts as user interaction (NVD says 6.1 and yes; MITRE says 7.2 and no). For a defender, the argument is academic. The message runs when it renders. Patch, then go read your audit log.

Sources

• The Hacker News — Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
• BleepingComputer — Russian hackers exploit Zimbra zero-click flaw for email theft
• The Hacker News — Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities