NSA, CISA, FBI, and allied agencies have warned Zimbra Collaboration Suite administrators about an ongoing Russian state-supported campaign that exploits CVE-2025-66376 in vulnerable Zimbra Classic UI deployments. The operation is attributed to LAUNDRY BEAR, also tracked by some vendors as Void Blizzard, and uses a custom capability called Ulej to run when a target views a malicious email in the webmail interface.[1]
This is not ordinary phishing that depends on a user clicking a link or opening an attachment. The joint advisory describes a view-based exploit: if the user opens the crafted message in a vulnerable ZCS webmail client, the JavaScript payload can execute in the browser context and start collecting mailbox data. That makes the alert important for organizations that still run Zimbra Classic UI, especially public-sector, defense, technology, media, NGO, and commercial networks that may be of intelligence interest.[1]
The flaw was first used as a zero-day during activity that began around July 2025, before the CVE was published and before the vendor patch was available. Zimbra later fixed the issue in ZCS 10.0.18 and 10.1.13, and NVD lists ZCS 10 before 10.0.18 and 10.1 before 10.1.13 as affected. CISA also placed CVE-2025-66376 in the Known Exploited Vulnerabilities catalog on March 18, 2026, with an April 1 remediation deadline for federal civilian agencies.[2][3][4]
The new July 23 advisory matters because the campaign has not ended simply because patches exist. The agencies say LAUNDRY BEAR continues to successfully exploit organizations that remain unpatched. Once Ulej runs, it attempts to steal the victim’s last 90 days of email, the organization Global Address List, the user’s email address, passwords, 2FA tokens, and newly created application passcodes.[1]
That account-level persistence is the part administrators should not miss. A patch can stop the same exploit path from working again, but it does not automatically revoke an app-specific password, reset a stolen mailbox password, remove exposed 2FA scratch codes, or undo already exfiltrated mail. This is the same defensive lesson behind recent email-token stories such as the Kratos Microsoft 365 session-theft takedown and Evilginx device-code phishing: mailbox compromise often survives after the first visible lure is gone.
What Zimbra administrators should check now
First, confirm the server version. ZCS 10.0 installations should be on 10.0.18 or later, and ZCS 10.1 installations should be on 10.1.13 or later. If immediate patching is not possible, the joint advisory recommends steering users away from the Classic ZCS webmail client until the environment is updated. Unsupported or externally exposed Zimbra systems deserve extra scrutiny because older branches often share similar webmail risk even when they are not the formally supported versions in the current advisory.
Second, treat suspicious activity as a mailbox incident, not just a web bug. The advisory says Ulej relies heavily on SOAP requests and that ZCS logs these requests by default in /opt/zimbra/log/mailbox.log. Useful hunting pivots include bursts of SearchGalRequest from one user, CreateAppSpecificPasswordRequest activity, especially when the new passcode is named ZimbraWeb, and GetScratchCodesRequest calls that could expose 2FA scratch codes.[1]
Third, revoke and rotate. For users that may have opened a malicious message in Classic UI, administrators should remove application passcodes, revoke 2FA scratch keys, reset passwords, review active sessions, and examine mailbox access over IMAP or other mail clients. If logs or endpoint review show local storage entries named in the zd_comp_YYYY-MM-DD pattern described by the advisory, use those dates to scope likely mailbox exfiltration.
Finally, do not dismiss the issue because the original CVE score looks like an XSS problem. In this campaign, the browser-side execution path is being used as an email-collection and credential-access mechanism against real organizations. The earlier Zimbra 10.1.19 Classic Web Client XSS patch story is a useful reminder that webmail rendering bugs are not cosmetic when the mailbox is the target.
References
- CISA, NSA, FBI, and partners, “Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite,” July 23, 2026.
- NSA press release on the Zimbra Collaboration Suite phishing campaign, July 23, 2026.
- NVD, CVE-2025-66376 detail and CISA KEV status.
- Zimbra Security Advisories, CVE-2025-66376 fixed in ZCS 10.0.18 and 10.1.13.
Leave a Comment