Russian Hackers Exploit Unpatched Zimbra XSS (CVE‑2025‑66376) to Steal Emails Across Government and Commercial Sectors
What Happened — The state‑backed group Laundry Bear has been leveraging CVE‑2025‑66376, a cross‑site scripting flaw in Zimbra Collaboration Suite, to harvest email content, credentials, and MFA tokens from vulnerable servers. The vulnerability was patched in November 2025, but attackers continue to target unpatched installations, exfiltrating up to 90 days of email data.
Why It Matters for Compliance & Audit Readiness
- Unpatched software defeats the “patch‑management” control required by SOC 2 CC6.1, leaving organizations without defensible evidence of due diligence.
- The view‑based XSS attack bypasses traditional phishing awareness training, highlighting the need for robust access‑control policies, MFA enforcement, and continuous monitoring of privileged email accounts.
- Documenting remediation steps (patch rollout, configuration checks, log‑review) provides the audit‑ready artifacts that SOC 2 auditors expect for the Security and Confidentiality principles.
Who Is Affected — Federal, state, and local government agencies; defense industrial base; education institutions; energy utilities; law‑enforcement; media outlets; NGOs; and technology firms that run Zimbra on‑prem or in private clouds.
Recommended Actions
- Verify Zimbra version across all mail servers; apply the November 2025 patch (or later) immediately.
- Enable strict Content‑Security‑Policy (CSP) headers to mitigate XSS execution.
- Enforce MFA for all email accounts and rotate tokens regularly.
- Deploy email‑gateway scanning for malicious HTML payloads.
- Update security‑awareness curricula to cover view‑based exploits and the importance of timely patching.
- Capture patch‑deployment logs, configuration baselines, and monitoring alerts as SOC 2 evidence.
Source: Help Net Security
Technical Notes — CVE‑2025‑66376 is an XSS flaw that executes JavaScript when a crafted HTML email is opened in the Zimbra web client. Exploited code steals session cookies, passwords, 2FA tokens, and the Global Address List, then forwards data to Docker‑based exfiltration servers (Flowerbed) using encrypted traffic and VPN obfuscation. Source: same as above