A Russian state-linked group has spent the past year reading other people's email without ever getting a victim to click a link. The flaw, tracked as CVE-2025-66376, sits in the classic web interface of Zimbra Collaboration Suite, a self-hosted alternative to Microsoft 365 or Google Workspace that many small hosting providers and mid-sized organisations run for their own mail. Attackers send a normal-looking HTML email that hides malicious code inside CSS @import rules — a trick that slips past Zimbra's content sanitizer. The code runs the moment the victim simply opens the message inside their own logged-in mailbox. No attachment, no link, no second step.
Once it runs, the script can pull the victim's last 90 days of mail, their full address book and organisation directory, any passwords saved in the webmail client, and stored two-factor scratch codes. In several cases it also created a new app-specific login passcode named "ZimbraWeb" inside the account — a quiet backdoor that keeps working even after the victim changes their password, unless someone specifically finds and revokes it.
What makes this one worth flagging now rather than when it first surfaced: the campaign has been running since around July 2025 and was still active as of February 2026, even though Zimbra shipped a fix for it back on 6 November 2025. CISA's advisory (AA26-204A) attributes the campaign to a Russian state-linked group tracked under several names — Laundry Bear, Void Blizzard, TA488, CL-STA-1114 — and confirms it is still going after unpatched Zimbra instances. Affected versions are Zimbra Collaboration 10.0 before 10.0.18 and 10.1 before 10.1.13.
What this means for your business
- This only applies if you, or an outsourced IT provider, run Zimbra Collaboration for company email — if your mail is on Microsoft 365 or Google Workspace, this specific flaw doesn't touch you.
- Check the version today. If it's older than 10.0.18 or 10.1.13, you've been running a known, actively exploited bug for eight months — patching now is overdue, not precautionary.
- Patching alone may not be enough if you were already exposed. Have whoever manages the mail server check every mailbox's app-specific passcodes for one you don't recognise, named "ZimbraWeb" or similar, and revoke it.
- Reset passwords and any stored 2FA scratch codes for accounts that were exposed, and move toward phishing-resistant MFA where Zimbra supports it — a stolen scratch code is as good as no second factor at all.
- Staff training won't stop this one — there's no suspicious link to spot, since simply opening the email is enough. The fix here is entirely on the server side.
An eight-month gap between a patch shipping and an attacker still finding unpatched targets is the real story — it's usually less about the flaw itself and more about nobody owning the update.