Russian threat actors are actively exploiting a Zimbra zero-day vulnerability to conduct sophisticated email theft operations. The campaign targets mailboxes by systematically querying for non-junk messages from the past 90 days, with attackers employing an advanced exfiltration infrastructure to steal sensitive communications.
How Does the Email Theft Process Work?
The malicious script queries targeted mailboxes for messages spanning 90 days, compressing the retrieved data before transferring it through a framework called Ulej. The stolen information is sent to attacker-controlled servers running a Python-based collection system named Flowerbed. This infrastructure includes safeguards to prevent redundant collection of previously exfiltrated emails, though messages from the current day are consistently gathered with each exploit execution.
What Exfiltration Methods Are Being Used?
The operation employs both HTTPS and DNS as covert transmission channels. For smaller data items, the malware encodes information in Base32 format and triggers DNS lookups through specially crafted image URLs. Larger files, including email archives and Global Address List contents, are transferred over HTTPS to the Flowerbed infrastructure. These connections are secured using Let’s Encrypt certificates and processed through an Nginx reverse proxy.
Understanding the Flowerbed Infrastructure
The Flowerbed setup utilizes Docker containers for various operational tasks, including HTTP and DNS exfiltration alongside health checks. To obscure their activities, the attackers employ VPN services like Mullvad. The system carefully stages JSON logs and payload files for exfiltration while automatically purging older files to maintain operational stealth.
According to CISA Advisory AA26-204A, evidence indicates that AI tools were used to assist in developing the Flowerbed codebase. This represents a growing trend of threat actors leveraging artificial intelligence to accelerate offensive cyber operations.
What Detection Opportunities Exist for Defenders?
Despite the stealthy nature of this campaign, defenders have several detection opportunities. ZCS mailbox logs may display unusual SOAP activity that indicates compromise. Additionally, entries in browser localStorage can reveal email exfiltration dates, which can assist incident response efforts.
What Actions Should Organizations Take?
Organizations are urged to urgently patch the CVE-2025-66376 vulnerability and consider alternative methods for email access to protect against these attacks. Security teams should revoke all Zimbra Application Passcodes and two-factor authentication scratch codes as a crucial step in mitigating the risks posed by this advanced persistent threat.
Source: Cybersecurity News