Just Opening the Email Was Enough: Russian Hackers Turned a Zimbra Zero-Day Into a Silent Mail Thief

What Happened?

The flaw sits in Zimbra Collaboration Suite, a webmail platform used by governments and universities around the world. It is tracked as CVE-2025-66376.

Scoring it gets awkward. MITRE rates it 7.2 and says viewing a message does not count as user interaction. NVD rates it 6.1 and says it does. Same bug, same behavior, two readings of one metric. CISA and Unit 42 both call the attack zero-click. Proofpoint prefers the term half click. Whatever you call it, the message runs when it renders and nothing else has to happen.

Here is the trick. Zimbra’s built in HTML cleaner is supposed to strip dangerous code out of incoming mail. The attackers broke their malicious code into pieces and hid the seams using fake CSS import statements and HTML comments. The cleaner looked at the fragments and saw nothing worth blocking. The browser then stitched the fragments back together into working JavaScript and ran it.

Opening or even previewing the message in the Zimbra web client is enough to fire it.

Once it runs, the script grabs the logged in user’s session token, their auto fill password, and any two factor scratch codes sitting in the browser. It then walks the company address book by brute forcing every two character name combination. Then it pulls the last 90 days of email and ships the whole archive out as a compressed file.

CISA has a name for the tool doing all this: Ulej, Russian for beehive. It is a custom built exfiltration and aggregation capability that starts pulling email and user data the moment the exploit lands. The stolen material goes to an unattributable virtual private server running a collection framework the group calls Flowerbed, then moves on to internal Russian network resources for review and long term storage.

One detail from the advisory stands out. CISA says the Flowerbed codebase shows signs that AI helped write it, and reads that reliance as evidence the group lacks serious in-house development skill. The same advisory notes the exploit itself was likely handed to Laundry Bear rather than built by it.

The nastiest part is persistence. The script quietly creates an app specific password on the mailbox, names it “ZimbraWeb,” and sends it back to the attackers. That password works over IMAP, POP3, and SMTP, and it skips two factor authentication completely. Even after the browser session ends, the door stays open.

Stolen data leaves through DNS lookups, which most mail filters never inspect. The command servers were disguised as Zimbra telemetry and email analytics domains so anyone reviewing outbound traffic would assume it was routine.

Activity began around July 2025. Synacor patched the hole on November 6, 2025 with ZCS versions 10.1.13 and 10.0.18, but described it only as a stored scripting bug in release notes, with no CVE attached at the time.

NVD did not publish an entry until January 5, 2026. CISA added it to the Known Exploited Vulnerabilities catalog on March 18, 2026, after a security firm published research tying the flaw to attacks on a Ukrainian government agency. Federal agencies were given until April 1 to patch under Binding Operational Directive 22-01.

What’s the Impact?

Between the patch in November and the public warning this week, unpatched servers sat exposed with almost no one aware.

CISA puts a number on it. More than 10 organizations have been successfully targeted since July 2025. The victim list covers the defense industrial base, federal and local government, law enforcement, technology firms, education, media, and non-governmental organizations. The targeting was manual and deliberate, not opportunistic scanning.

Worse, compromised mailboxes became launch pads. Since at least November 2025, the group has been sending poisoned emails from real accounts belonging to real organizations, which sail past filters and colleagues alike.

Detection was near impossible. The code ran inside the browser tab, not on disk, so endpoint tools had almost nothing to flag.

The campaign is not over. Proofpoint says it has seen no activity from the group since February 2026, when the operators tore down their infrastructure. But the advisory is blunt that the vulnerability continues to be successfully exploited against unpatched systems.

One vendor’s telemetry going quiet is not the same as the threat ending. Any unpatched Zimbra server is now exposed to anyone, not just this group, because the flaw is publicly documented and sitting in the KEV catalog.

How to Avoid This

Update Zimbra now. Version 10.1.20, released in July 2026, is the current target and fixes several additional stored scripting issues beyond this one. If you run the 10.0 branch, 10.0.18 is your minimum. Anything below 10.0.18 or 10.1.13 is vulnerable to this flaw. If patching has to wait, move users to a different mail client until it is done.

One item in the 10.1.20 release deserves attention. It closes a hole that let an authenticated attacker bypass email forwarding restrictions. Forwarding rules are a favorite persistence trick because they keep leaking mail long after a password reset.

• Check /opt/zimbra/log/audit.log for CreateAppSpecificPassword calls. Delete anything named ZimbraWeb or similar, then force a password reset and revoke active sessions.
• Look for unusual SOAP requests, unexpected IMAP enablement, and new application passcodes on mail accounts.
• Watch DNS traffic leaving mail servers. Long random subdomain lookups pointed at unfamiliar domains are a red flag.
• Block or alert on the command server domains listed in the IOC artifact.
• Do not trust internal senders by default. A message from a real colleague can still carry an exploit if their mailbox is owned.
• Security awareness training will not help here. There is nothing for the user to avoid doing.
• Treat “no CVE assigned” release notes as suspicious. Quiet security fixes are still security fixes.