unit42 · Crawled Jul 23, 2026
Russian Global Webmail Espionage
18 IoCs 1 Actors 1 CVEs
Read original article ↗
AI Summary
Unit 42 has identified a persistent cyberespionage campaign, tracked as CL-STA-1114, attributed to a Russian threat actor. The campaign targets Zimbra webmail users in government, defense, transportation, and financial sectors across NATO, Ukraine, CIS, and African countries. Attackers exploit CVE-2025-66376 to deliver a zero-click JavaScript payload that exfiltrates credentials, email archives, and 2FA tokens. The activity highlights ongoing state-sponsored threats leveraging unpatched vulnerabilities in widely used collaboration platforms.
AI-extracted · verify before operational use
Extracted Entities 2 found
Indicators of Compromise 18 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 37[.]120[.]247[.]228 | Details → |
| IP | 64[.]226[.]124[.]190 | Details → |
| IP | 104[.]248[.]134[.]194 | Details → |
| IP | 185[.]86[.]79[.]95 | Details → |
| IP | 193[.]238[.]152[.]66 | Details → |
| IP | 194[.]156[.]103[.]193 | Details → |
| IP | 216[.]252[.]238[.]18 | Details → |
| IP | 216[.]252[.]238[.]64 | Details → |
| IP | 216[.]252[.]238[.]104 | Details → |
| Domain | analyticemailmeter[.]com | Details → |
| Domain | emailanalytics[.]com[.]ua | Details → |
| Domain | istc-cloud[.]com | Details → |
| Domain | mailnalysis[.]com | Details → |
| Domain | synacorzimbra[.]nl | Details → |
| Domain | zimbra-metadata[.]com | Details → |
| Domain | zimbrastat[.]com | Details → |
| Domain | zimbrasoft[.]com[.]ua | Details → |
| Domain | zmailanalytics[.]com | Details → |
MITRE ATT&CK TTPs 23 techniques
T1003.001 LSASS Memory · Credential Access T1027 Obfuscated Files or Information · Defense Evasion T1055 Process Injection · Defense Evasion T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1070.004 File Deletion · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1071.003 Mail Protocols · Command And Control T1071.004 DNS · Command And Control T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1110 Brute Force · Credential Access T1114 Email Collection · Collection T1190 Exploit Public-Facing Application · Initial Access T1203 Exploitation for Client Execution · Execution T1204.002 Malicious File · Execution T1485 Data Destruction · Impact T1496 Resource Hijacking · Impact T1539 Steal Web Session Cookie · Credential Access T1557 Adversary-in-the-Middle · Credential Access T1558.003 Kerberoasting · Credential Access T1566 Phishing · Initial Access