Russian State‑Sponsored Group Exploits Zimbra XSS Flaw to Steal Email, Credentials, and 2FA Tokens
What Happened — The Russian‑linked Laundry Bear (Void Blizzard) leveraged CVE‑2025‑66376, a cross‑site scripting flaw in Zimbra Collaboration Suite’s Classic UI, to execute JavaScript from malicious HTML email. The zero‑click attack harvested the last 90 days of mailbox data, passwords, Global Address List entries, and two‑factor authentication tokens, then exfiltrated them via DNS and HTTPS.
Why It Matters for Compliance & Audit Readiness
- The incident demonstrates how an unpatched web‑application vulnerability can bypass MFA and expose sensitive data, a scenario SOC 2 Access Controls are designed to detect and mitigate.
- Continuous evidence of patch management and credential‑access monitoring is essential to prove due diligence during a SOC 2 audit.
- Mapping this breach to the “Logical Access” and “System Operations” criteria helps build a defensible audit trail and supports remediation verification.
Who Is Affected – Defense‑industrial‑base firms, federal and local government agencies, education institutions, energy providers, law‑enforcement, media outlets, NGOs, and technology companies that run Zimbra Collaboration servers.
Recommended Actions
- Verify that all Zimbra installations are updated to the latest patched version (post‑Nov 2025).
- Review CISA‑published IOCs and scan for connections to the listed malicious domains.
- Enforce strict MFA enforcement that blocks legacy passcode authentication and monitor for anomalous mailbox access patterns.
Source: BleepingComputer
Technical Notes – The exploit uses a stored XSS payload in crafted HTML email (CVE‑2025‑66376). Data exfiltration occurs over DNS A‑record queries for small payloads and HTTPS POSTs for larger mailbox archives. Attackers also deploy AiTM phishing kits that mimic Zimbra login portals to harvest credentials and session cookies. Source: [CISA Advisory]