Unit 42 has issued an advisory regarding a persistent cyberespionage campaign identified as CL-STA-1114, which targets Zimbra webmail systems. This campaign is attributed to a Russian threat actor known as Void Blizzard or LAUNDRY BEAR. The attackers exploit a vulnerability in the Zimbra Collaboration Suite (ZCS), specifically CVE-2025-66376, using zero-click phishing emails to exfiltrate sensitive user data without requiring any interaction from the recipient. Organizations in sectors such as government, defense, transportation, and finance across NATO member states, Ukraine, CIS countries, and Africa are particularly at risk. Immediate action is advised to patch vulnerable systems.
What the Advisory Covers
The advisory details the tactics, techniques, and procedures (TTPs) employed by the threat actors in this campaign. It highlights the use of zero-click phishing emails that exploit CVE-2025-66376, allowing attackers to inject malicious JavaScript payloads into the victim’s browser without any user interaction.
Affected Products and Versions
- Zimbra Collaboration Suite (ZCS) – vulnerable versions are those that have not been patched against CVE-2025-66376.
Severity and Exploitation Status
The exploitation status of CVE-2025-66376 is active, with ongoing targeting of unpatched ZCS instances. The advisory does not specify a severity rating.
Available Patches or Fixed Versions
No specific patches or fixed versions are mentioned in the advisory. Organizations are urged to apply any available updates to ZCS to mitigate the risk.
Mitigations and Workarounds
No specific workarounds are provided. However, organizations should ensure that their ZCS installations are up to date and monitor for any suspicious activity.
Indicators of Compromise
IP Addresses
- 37.120.247[.]228
- 64.226.124[.]190
- 104.248.134[.]194
- 185.86.79[.]95
- 193.238.152[.]66
- 194.156.103[.]193
- 216.252.238[.]18
- 216.252.238[.]64
- 216.252.238[.]104
Domains
- analyticemailmeter[.]com
- emailanalytics[.]com[.]ua
- istc-cloud[.]com
- mailnalysis[.]com
- synacorzimbra[.]nl
- zimbra-metadata[.]com
- zimbrastat[.]com
- zimbrasoft[.]com[.]ua
- zmailanalytics[.]com
For further details, refer to the Unit 42 advisory.
Organizations are encouraged to remain vigilant and proactive in their cybersecurity measures to defend against such threats.
