Executive Summary
Unit 42 has identified a persistent cyberespionage campaign, tracked as CL-STA-1114 (overlapping with Void Blizzard and LAUNDRY BEAR), targeting Zimbra webmail instances globally. The campaign primarily impacts government, defense, transportation, and financial sectors across NATO member states, Ukraine, Africa, and CIS countries.
The attackers utilize a zero-click exploit for CVE-2025-66376, a vulnerability in the Zimbra Collaboration Suite (ZCS). By delivering phishing emails with malicious HTML attachments or embedded code, the threat actors inject obfuscated JavaScript that automatically exfiltrates sensitive data without requiring the victim to click a link or open a file.
This campaign represents a significant risk to organizations relying on Zimbra for communication, as it enables the mass collection of login credentials, two-factor authentication (2FA) scratch codes, and up to 90 days of email and search history. Organizations are urged to prioritize patching ZCS instances to mitigate this ongoing threat.