Date: 07/24/2026
Severity: High
Summary
Cyberespionage campaign (CL-STA-1114), linked to the Russian threat actor tracked as Void Blizzard/LAUNDRY BEAR, targeting Zimbra webmail used by government, defense, transportation, and financial organizations across NATO countries, Ukraine, CIS, and Africa. The campaign exploits the zero-click Zimbra vulnerability CVE-2025-66376 to automatically inject malicious JavaScript that steals credentials, email archives, search history, and other sensitive data without user interaction. Threat actors are actively exploiting unpatched Zimbra Collaboration Suite (ZCS) instances, highlighting the importance of timely patching and email security protections.
Indicators of Compromise (IOC) List
Domain/Urls | analyticemailmeter.com emailanalytics.com.ua istc-cloud.com mailnalysis.com synacorzimbra.nl zimbra-metadata.com zimbrasoft.com.ua zimbrastat.com zmailanalytics.com |
IP Address | 104.248.134.194 185.86.79.95 193.238.152.66 194.156.103.193 216.252.238.104 216.252.238.18 216.252.238.64 37.120.247.228 64.226.124.190 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "zimbrasoft.com.ua" or url like "zimbrasoft.com.ua" or siteurl like "zimbrasoft.com.ua" or domainname like "synacorzimbra.nl" or url like "synacorzimbra.nl" or siteurl like "synacorzimbra.nl" or domainname like "emailanalytics.com.ua" or url like "emailanalytics.com.ua" or siteurl like "emailanalytics.com.ua" or domainname like "zimbra-metadata.com" or url like "zimbra-metadata.com" or siteurl like "zimbra-metadata.com" or domainname like "mailnalysis.com" or url like "mailnalysis.com" or siteurl like "mailnalysis.com" or domainname like "zmailanalytics.com" or url like "zmailanalytics.com" or siteurl like "zmailanalytics.com" or domainname like "istc-cloud.com" or url like "istc-cloud.com" or siteurl like "istc-cloud.com" or domainname like "analyticemailmeter.com" or url like "analyticemailmeter.com" or siteurl like "analyticemailmeter.com" or domainname like "zimbrastat.com" or url like "zimbrastat.com" or siteurl like "zimbrastat.com" |
Detection Query 2 : | dstipaddress IN ("64.226.124.190","104.248.134.194","37.120.247.228","216.252.238.64","194.156.103.193","216.252.238.18","185.86.79.95","216.252.238.104","193.238.152.66") or srcipaddress IN ("64.226.124.190","104.248.134.194","37.120.247.228","216.252.238.64","194.156.103.193","216.252.238.18","185.86.79.95","216.252.238.104","193.238.152.66") |
Reference:
https://unit42.paloaltonetworks.com/russian-webmail-espionage/