{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asynacorzimbra_collaboration_suite/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":["TA488","Void Blizzard","Laundry Bear"],"_cs_cpes":["cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2025-66376"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zimbra Collaboration Suite","Zimbra Collaboration Suite (\u003c= 2025-11)","Microsoft Exchange"],"_cs_severities":["critical"],"_cs_tags":["espionage","xss","zimbra","apt","state-sponsored","half-click","cve-2025-66376"],"_cs_type":"threat","_cs_vendors":["Zimbra","Microsoft"],"content_html":"\u003cp\u003eProofpoint, in coordination with the NSA and FBI, has identified TA488 (also known as Void Blizzard or Laundry Bear), a Russia-aligned threat actor, exploiting a critical cross-site scripting (XSS) vulnerability, CVE-2025-66376, in Zimbra Collaboration Suite mailservers. This campaign, active for at least five months during 2025, leveraged a \u0026quot;half-click\u0026quot; exploit, meaning victims needed only to open or preview a specially crafted email for malicious JavaScript to execute. The attacks primarily targeted Ukrainian government entities, along with US government, high science, and defense industrial base organizations. After successful exploitation, TA488 established persistent access to compromised systems, stole credentials and two-factor authentication codes, and exfiltrated emails using a custom malware Proofpoint tracks as \u0026quot;ZimReaper.\u0026quot; The actor's use of this stealthy method underscores a continued focus by Russian state-sponsored groups on exploiting webmail vulnerabilities to achieve espionage objectives.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access \u0026amp; Exploitation (CVE-2025-66376):\u003c/strong\u003e TA488 sends specially crafted emails from adversary-controlled Proton Mail accounts or previously compromised addresses. These emails contain an embedded HTML/JavaScript payload that exploits CVE-2025-66376 by using tag-splitting techniques with fake CSS \u003ccode\u003e@import\u003c/code\u003e directives and HTML comments to bypass Zimbra's client-side HTML sanitizer.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eClient-Side JavaScript Execution:\u003c/strong\u003e When a victim opens or previews the malicious email in a vulnerable Zimbra webmail client, the sanitizer fails, allowing the browser to reconstruct and execute the embedded JavaScript (ZimReaper) within the context of the user's authenticated webmail session.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eObfuscation \u0026amp; Persistence Check:\u003c/strong\u003e The initial JavaScript, after execution, checks for a script element with the ID \u003ccode\u003ezmb_pl_v3_\u003c/code\u003e to avoid re-execution and subsequently XOR decrypts a second, obfuscated JavaScript payload.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCredential \u0026amp; System Information Collection:\u003c/strong\u003e The decrypted ZimReaper JavaScript pings the attacker's C2 server to log the successful exploit and then proceeds to steal the Cross-Site Request Forgery (CSRF) token, auto-complete passwords, two-factor authentication codes, and details about the Zimbra installation from the browser.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence Establishment:\u003c/strong\u003e ZimReaper utilizes Zimbra APIs, specifically \u003ccode\u003eCreateAppSpecificPasswordRequest\u003c/code\u003e, to generate a new app-specific password under the name \u0026quot;ZimbraWeb.\u0026quot; This password provides TA488 with persistent access to the mailserver via IMAP, POP3, or SMTP, bypassing 2FA requirements.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData Exfiltration via DNS Queries:\u003c/strong\u003e The collected sensitive information, including 2FA scratch codes, Zimbra version, user email, the newly created app-specific password, auto-fill password, and the Zimbra server URL, is exfiltrated to the C2 server via DNS queries using a specific \u003ccode\u003ekey.Base32EncodedData.unique_identifier.domain\u003c/code\u003e schema.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBulk Email Exfiltration via HTTP POST:\u003c/strong\u003e ZimReaper iterates through up to 90 days of the targeted user's emails. It then leverages Zimbra's built-in export functionality to exfiltrate these messages as a TGZ (compressed tarball) file through an HTTP POST request to the attacker's C2 infrastructure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2025-66376 by TA488 results in significant compromise of targeted organizations, particularly within government, high science, and the defense industrial base sectors. The primary impact is the unauthorized exfiltration of sensitive email communications, user credentials, and two-factor authentication codes, leading to a severe loss of confidentiality. Furthermore, the establishment of persistent access via app-specific passwords enables the threat actor to maintain long-term presence within the mail environment, potentially send further spear-phishing campaigns from compromised legitimate accounts, or continue manual data exfiltration. The targeting of Ukrainian government entities and US defense contractors indicates a clear espionage objective, posing a national security risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2025-66376 on all Zimbra Collaboration Suite mailservers immediately to prevent exploitation.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect ZimReaper DNS Exfiltration Activity\u0026quot; to your SIEM and monitor for suspicious DNS queries that match the described pattern (\u003ccode\u003ekey.Base32EncodedData.unique_identifier.domain\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect ZimReaper Bulk Email Exfiltration via Webmail Export\u0026quot; to your SIEM and monitor Zimbra webserver logs for HTTP POST requests to \u003ccode\u003e/service/export\u003c/code\u003e with \u003ccode\u003efmt=tgz\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eReview Zimbra audit logs for the creation of new app-specific passwords, particularly those named \u0026quot;ZimbraWeb\u0026quot;, which may indicate unauthorized persistence.\u003c/li\u003e\n\u003cli\u003eEnhance email gateway security to detect and block emails containing complex, obfuscated HTML/JavaScript payloads, especially those targeting known Zimbra vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T15:16:34Z","date_published":"2026-07-23T14:04:47Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ta488-zimbra-half-click/","summary":"Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.","title":"TA488 Exploits Zimbra Mailservers with Half-Click Vulnerability CVE-2025-66376","url":"https://feed.craftedsignal.io/briefs/2026-07-ta488-zimbra-half-click/"},{"_cs_actors":["FrostyNeighbor"],"_cs_cpes":["cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*","cpe:2.3:a:mdaemon:email_server:*:*:*:*:*:*:*:*","cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:a:ruoyi:ruoyi:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.4,"id":"CVE-2025-27915"},{"cvss":6.1,"id":"CVE-2025-3929"},{"cvss":6.1,"id":"CVE-2023-43770"},{"cvss":6.1,"id":"CVE-2026-8496"},{"cvss":6.1,"id":"CVE-2024-42900"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["Cobalt Strike","WinRAR","Roundcube","Webmail (\u003c 1.5.10)","Webmail (\u003c 1.6.11)","SOGo webmail (\u003c 5.12.8)","Zimbra webmail","MDaemon Email Server","Kerio Webmail"],"_cs_severities":["high"],"_cs_tags":["frostyneighbor","cyberespionage","cobaltstrike","picassoloader","ukraine"],"_cs_type":"threat","_cs_vendors":["Microsoft","Cloudflare","Roundcube","WinRAR","Alinto","Zimbra","MDaemon Technologies","Kerio Technologies"],"content_html":"\u003cp\u003eESET researchers have identified new activity from FrostyNeighbor (aka Ghostwriter, UNC1151, UAC-0057, TA445, PUSHCHA, Storm-0257) targeting governmental organizations in Ukraine starting in March 2026. FrostyNeighbor, believed to be aligned with Belarus' interests, has been active since at least 2016, primarily targeting countries neighboring Belarus. The group employs spearphishing, disinformation campaigns, and credential harvesting to compromise various entities. This recent campaign utilizes malicious PDFs delivered via spearphishing emails, exploiting server-side validation to deliver a malicious payload only to victims with Ukrainian IP addresses. The group continually updates its toolset and compromise chains to evade detection, with a focus on Ukraine, Poland, and Lithuania. The attack culminates in the deployment of a Cobalt Strike beacon for persistent access and control.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA spearphishing email delivers a malicious PDF file (e.g., 53_7.03.2026_R.pdf) impersonating Ukrtelecom, a Ukrainian telecommunications company.\u003c/li\u003e\n\u003cli\u003eIf the victim's IP address is from Ukraine, the server delivers a RAR archive (e.g., 53_7.03.2026_R.rar) containing a JavaScript dropper (53_7.03.2026_R.js). Otherwise, a benign PDF is served.\u003c/li\u003e\n\u003cli\u003eThe JavaScript dropper (53_7.03.2026_R.js) executes and drops a decoy PDF file to the victim, simultaneously executing a second-stage JavaScript downloader (PicassoLoader) named Update.js, which is embedded in base64 within the first-stage script.\u003c/li\u003e\n\u003cli\u003eThe PicassoLoader script (Update.js) downloads a scheduled task template (config.xml) from a C\u0026amp;C server (book-happy.needbinding[.]icu) disguised as a JPG image (1GreenAM.jpg), but the server responds with text-based content, advertising an XML attachment.\u003c/li\u003e\n\u003cli\u003eThe script creates a scheduled task to achieve persistence. The scheduled task is configured to execute PicassoLoader (Update.js) periodically.\u003c/li\u003e\n\u003cli\u003eThe PicassoLoader script fingerprints the victim's computer, sending data to a C\u0026amp;C server using a URL like \u003ca href=\"https://book-happy.needbinding\"\u003ehttps://book-happy.needbinding\u003c/a\u003e[.]icu/employment/documents-and-resources.\u003c/li\u003e\n\u003cli\u003eBased on the fingerprint, the C\u0026amp;C server may deliver a Cobalt Strike beacon.\u003c/li\u003e\n\u003cli\u003eThe Cobalt Strike beacon establishes persistence by copying rundll32.exe, writing a DLL to disk, and creating a registry entry to execute the copied rundll32.exe with the DLL.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eFrostyNeighbor's campaigns primarily target governmental, military, and key sectors in Eastern Europe, with a focus on Ukraine, Poland, and Lithuania. A successful compromise allows the attacker to gain persistent access to the victim's systems, enabling them to conduct cyberespionage activities, including data theft, surveillance, and potential disruption of critical infrastructure. While Ukrainian targeting focuses on military, defense, and governmental entities, victimology in Poland and Lithuania includes sectors like industrial and manufacturing, healthcare and pharmaceuticals, logistics, and governmental organizations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor network traffic for connections to the C\u0026amp;C server domains listed in the IOC table, specifically \u003ccode\u003ebook-happy.needbinding[.]icu\u003c/code\u003e and \u003ccode\u003enama-belakang.nebao[.]icu\u003c/code\u003e to identify potential Cobalt Strike beacon activity.\u003c/li\u003e\n\u003cli\u003eImplement the provided Sigma rule to detect the execution of JavaScript files dropping other JavaScript files, indicative of PicassoLoader activity.\u003c/li\u003e\n\u003cli\u003eInspect scheduled tasks for suspicious configurations that execute JavaScript files from the %AppData% directory to identify potentially compromised systems.\u003c/li\u003e\n\u003cli\u003eBlock the malicious URLs listed in the IOC table at the network level, particularly \u003ccode\u003ehttps://book-happy.needbinding[.]icu/wp-content/uploads/2023/10/1GreenAM.jpg\u003c/code\u003e, to prevent the download of malicious scheduled task templates.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T14:07:56Z","date_published":"2026-05-15T07:00:16Z","id":"https://feed.craftedsignal.io/briefs/2026-05-frostyneighbor-ukraine/","summary":"The FrostyNeighbor threat actor is targeting Ukrainian governmental organizations with spearphishing emails containing malicious PDFs that deliver a JavaScript dropper (PicassoLoader) and ultimately a Cobalt Strike beacon.","title":"FrostyNeighbor Targets Ukraine with Updated PicassoLoader Chain","url":"https://feed.craftedsignal.io/briefs/2026-05-frostyneighbor-ukraine/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}