Full Report
Phishing for dummies
Analysis Summary
# Incident Report: Persistent Exploitation of Zimbra CVE-2025-66376 by Void Blizzard
## Executive Summary
For over a year, the Russian state-sponsored threat group Void Blizzard (Laundry Bear) exploited a zero-day Cross-Site Scripting (XSS) vulnerability in the Zimbra Collaboration Suite. The attack was notable for requiring zero user interaction beyond viewing a malicious email, leading to the widespread theft of internal directories, 2FA tokens, and 90 days of historical email data across multiple Western critical sectors.
## Incident Details
- **Discovery Date:** July 23, 2026 (Public Advisory)
- **Incident Date:** July 2025 – Present
- **Affected Organizations:** Multiple Western organizations (Government, Defense, Energy, etc.)
- **Sector:** Cross-sector (Government, Education, Law Enforcement, NGO, Tech, Media)
- **Geography:** International (Primarily US, UK, and Western allies)
## Timeline of Events
### Initial Access
- **Date/Time:** July 2025 (Initial zero-day exploit)
- **Vector:** Phishing via malware-laden HTML emails.
- **Details:** Attackers exploited CVE-2025-66376, an XSS vulnerability in Zimbra. The attack triggered automatically upon the victim viewing the email in the web client.
### Lateral Movement
- **Details:** After capturing Global Address Lists (GAL) and credentials, the attackers leveraged stolen 2FA tokens and application passcodes to move between accounts and maintain persistence within the email environment.
### Data Exfiltration/Impact
- **Details:** Automated exfiltration of the last 90 days of email communications, stolen passwords, 2FA tokens, and organizational directories. Data was sent to an external VPS.
### Detection & Response
- **Detection:** Identified by a coalition of 27 international agencies (including FBI/CISA/NCSC).
- **Response Actions:** Joint security alert issued; patch released in November 2025; organizations advised to update and restrict webmail use.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2025-66376 (XSS) via HTML email.
- **Persistence:** Modification of account preferences and creation/theft of application passcodes.
- **Privilege Escalation:** Use of stolen 2FA tokens to bypass security controls.
- **Defense Evasion:** Use of unattributable Virtual Private Servers (VPS).
- **Credential Access:** Scraping of passwords and authentication tokens from the web-based client.
- **Discovery:** Gathering Global Address Lists (GAL) to map organization hierarchies.
- **Collection:** Gathering 90-day email history and directories using the "Flowerbed" framework.
- **Exfiltration:** Automated theft via a Python/Docker-based framework (Flowerbed), potentially AI-assisted.
- **Impact:** Covert acquisition of sensitive state and commercial intelligence.
## Impact Assessment
- **Financial:** Not explicitly disclosed; likely high due to response costs and intelligence loss.
- **Data Breach:** High; 90 days of email history and full directory lists stolen from numerous organizations.
- **Operational:** Disruption of secure communications; requirement to patch and rotate all credentials/2FA.
- **Reputational:** Significant loss of trust in internal communications for affected agencies.
## Indicators of Compromise
### Network Indicators
- ivanka.zurabishvili@proton[.]me
- zmul1@buildandconsulting[.]com
- garrysmithme@pinmx[.]net
- hostingclient@pinmx[.]net
### File/System Indicators
- **Flowerbed Framework:** Python-based collection tool using Docker containerization.
- **CVE-2025-66376:** Targeted Zimbra XSS vulnerability.
## Response Actions
- **Containment:** Agencies recommended minimizing the use of the ZCS webmail client.
- **Eradication:** Deployment of the November 2025 patch for the Zimbra Collaboration Suite.
- **Recovery:** Review of 31-page IOC list to identify compromised accounts and reset credentials.
## Lessons Learned
- **Zero-Interaction Risks:** Vulnerabilities that trigger on "view" significantly reduce the window for human detection via standard phishing training.
- **Patch Management:** The lag between the start of exploitation (July) and the patch (November) provided attackers a 4-month zero-day window.
- **AI in Malware:** The mention of AI-assisted development in the "Flowerbed" framework indicates a shift toward faster, modular tool development for state-sponsored actors.
## Recommendations
- **Patching:** Immediately update Zimbra Collaboration Suite to versions containing the November 2025 patch.
- **Client Restrictions:** Use thick-client email applications rather than web-based clients until patches are fully verified.
- **Credential Rotation:** Perform a mandatory reset of passwords and 2FA tokens for any user who viewed suspicious emails prior to patching.
- **Enhanced Monitoring:** Implement logging for unusual directory (GAL) export activities or sudden spikes in email data access.