Operation GhostMail: Analysis of Russian APT Exploitation of Zimbra XSS

Operation GhostMail is a high-stakes cyber-espionage campaign attributed to the Russian threat actor APT28 (Fancy Bear). By exploiting a critical stored Cross-Site Scripting (XSS) vulnerability in Zimbra Collaboration software, the group has successfully targeted Ukrainian government agencies and critical infrastructure.

The campaign marks a significant escalation in APT28’s technical tactics. Unlike traditional phishing that relies on tricking a user into clicking a link or downloading a file, this operation utilizes a “zero-click” trigger mechanism. By embedding obfuscated JavaScript directly into the HTML body of an email, the exploit (CVE-2025-66376) is triggered the moment a victim simply views the message within their Zimbra webmail client.

The goal of this operation is a simple but devastating bypass of authentication to steal sensitive communications and maintain a long-term “ghost” presence within compromised mail servers.

The campaign centers on CVE-2025-66376, a flaw that allows attackers to bypass security sanitization and execute malicious code directly within a user’s browser session.

Unlike traditional phishing that requires a user to click a suspicious link or download a file, Operation GhostMail relies on the automatic execution of JavaScript when an email is viewed.

1. Initial Contact: Phishing emails are sent from compromised academic (.edu) or student accounts to appear legitimate.
2. Exploitation: The email body contains heavily obfuscated JavaScript. Once the Zimbra webmail interface renders the email, the script triggers CVE-2025-66376.
3. Data Theft: The script instantly targets the ZMBAuthToken (session token), CSRF tokens, and 2FA codes.
4. Exfiltration: Data is funneled out via a dual-channel method using HTTPS (for bulk data) and DNS (for stealthy communication).

The following infrastructure has been identified by CERT-UA as being used for data exfiltration and C2 operations during this campaign:

[Delivery of Phishing Email via Compromised .edu Accounts]-> [Exploitation of Zimbra Stored XSS (CVE-2025-66376)]-> [Automatic Execution of Obfuscated JavaScript in Victim’s Session]-> [Theft of ZMBAuthToken, CSRF Tokens, and 2FA Codes]-> [Unauthorized Access to User Mailbox and Webmail Sessions]-> [Establishment of Persistent Access via Stolen Session Tokens]-> [Dual-Channel Data Exfiltration via HTTPS and DNS]-> [Long-term Mailbox Monitoring and Intelligence Gathering]

The sophistication of Operation GhostMail lies in its ability to compromise accounts silently. Once the session token (ZMBAuthToken) is stolen, attackers can bypass 2FA entirely and monitor mailboxes for up to 90 days.

• Priority 1: Patch Zimbra. Organizations must upgrade to Zimbra 10.1.13 or 10.0.18 immediately to close the XSS loophole.
• Monitor for Anomalies: Look for unusual DNS queries or outbound traffic to the IPs listed above.
• Audit Webmail Logs: Check for unauthorized access via session tokens from unexpected geographical locations.

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.