{
  "Event": {
    "analysis": "1",
    "date": "2026-07-23",
    "extends_uuid": "",
    "info": "[Threat Intel] Global Webmail Espionage",
    "protected": false,
    "publish_timestamp": "1785586370",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1785586369",
    "uuid": "e50f4817-aa2f-4840-983f-bc3a9df47ff5",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0afe32",
        "local": false,
        "name": "misp-galaxy:producer=\"Palo Alto\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5539fe",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#9f6bd9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"",
        "relationship_type": ""
      },
      {
        "colour": "#36a9d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"",
        "relationship_type": ""
      },
      {
        "colour": "#e556be",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Forwarding Rule - T1114.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#70b0b5",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Brute Force - T1110\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#23cf0e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Email Collection - T1114.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e4d611",
        "local": false,
        "name": "misp-galaxy:target-information=\"Ukraine\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Void Blizzard\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784862034",
        "to_ids": false,
        "type": "link",
        "uuid": "c5357b49-d93d-4eb3-abbd-560f71f4a81c",
        "value": "https://unit42.paloaltonetworks.com/russian-webmail-espionage/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784862034",
        "to_ids": false,
        "type": "text",
        "uuid": "8385e519-8d8a-426d-af6a-37eb04272a69",
        "value": "A persistent cyberespionage campaign tracked as CL-STA-1114, overlapping with Russian threat actor activity known as Void Blizzard and LAUNDRY BEAR, has been targeting Zimbra webmail in government, defense, transportation, and financial organizations. The campaign focuses on NATO member states, Ukraine, Commonwealth of Independent States countries, and Africa. Attackers exploit CVE-2025-66376, a vulnerability in Zimbra Collaboration Suite, using zero-click phishing emails that automatically inject malicious JavaScript payloads without user interaction. The payload exfiltrates sensitive data including login credentials, email archives, CSRF tokens, 2FA scratch codes, and 90 days of email history to command and control servers. Active since 2024, the campaign targeting Zimbra servers began in July 2025, utilizing HTML attachments with obfuscated Base64-encoded scripts that deploy SVG elements to inject the JavaScript into victims' browsers."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784862034",
        "to_ids": false,
        "type": "text",
        "uuid": "741a426a-fe66-4321-a379-a29a8863bed6",
        "value": "Name: Global Webmail Espionage\nAuthor: AlienVault\nAdversary: Void Blizzard\nTags: [\"cyberespionage\", \"laundry bear\", \"cve-2025-66376\", \"zimbra\", \"russian threat actor\", \"zero-click phishing\", \"javascript injection\", \"void blizzard\", \"cl-sta-1114\"]\nTgtd countries: [\"Ukraine\"]\nMlwr families: []\nAttack_ids: [\"T1056.001\", \"T1059.007\", \"T1539\", \"T1566.002\", \"T1566.001\", \"T1082\", \"T1140\", \"T1567\", \"T1185\", \"T1016\", \"T1087\", \"T1114.003\", \"T1041\", \"T1110\", \"T1078\", \"T1027\", \"T1114.002\", \"T1189\", \"T1071.001\"]\nIndustries: [\"Government\", \"Defense\", \"Transportation\", \"Finance\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785572165",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "5094d174-3e05-4778-9cf6-dfdce7dde838",
        "value": "CL-STA-1114",
        "Tag": [
          {
            "colour": "#0afe32",
            "local": false,
            "name": "misp-galaxy:producer=\"Palo Alto\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579612",
        "to_ids": true,
        "type": "domain",
        "uuid": "680df68f-0456-4995-b454-3d1c4ab5d89e",
        "value": "zimbra-metadata.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579633",
        "to_ids": true,
        "type": "domain",
        "uuid": "1cf9bef3-6187-414d-a788-a71f5c19a1e2",
        "value": "emailanalytics.com.ua",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579655",
        "to_ids": true,
        "type": "domain",
        "uuid": "bc0791e1-85de-44d0-9911-23ba55decd1c",
        "value": "mailnalysis.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579676",
        "to_ids": true,
        "type": "domain",
        "uuid": "ac26ae9d-c9b8-417c-bc99-e6d22c24e312",
        "value": "analyticemailmeter.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579697",
        "to_ids": true,
        "type": "domain",
        "uuid": "00878221-a99c-4767-adbd-76c9c575053d",
        "value": "zimbrastat.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579718",
        "to_ids": true,
        "type": "domain",
        "uuid": "2a26e850-d897-4f77-8a35-de277258e4e9",
        "value": "zimbrasoft.com.ua",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784862034",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "f5f69b2e-2b4d-4e7d-8a64-234074884c8f",
        "value": "CVE-2025-66376"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579739",
        "to_ids": true,
        "type": "domain",
        "uuid": "51527724-7cb3-4357-821c-5fd04a750e20",
        "value": "istc-cloud.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579760",
        "to_ids": true,
        "type": "domain",
        "uuid": "8241fabb-268f-414d-bb41-531a2c6d532a",
        "value": "synacorzimbra.nl",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579782",
        "to_ids": true,
        "type": "domain",
        "uuid": "76283f01-d945-47e8-913c-b974612e439b",
        "value": "zmailanalytics.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579803",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "44721211-55a4-45f2-95ae-5d04db4194bd",
        "value": "185.86.79.95",
        "Tag": [
          {
            "colour": "#01e80b",
            "local": false,
            "name": "asn:asn=\"201094\"",
            "relationship_type": ""
          },
          {
            "colour": "#b17513",
            "local": false,
            "name": "asn:as-owner=\"GMHOST\"",
            "relationship_type": ""
          },
          {
            "colour": "#02bf45",
            "local": false,
            "name": "asn:as-country=\"UA\"",
            "relationship_type": ""
          },
          {
            "colour": "#8651e1",
            "local": false,
            "name": "misp-galaxy:country=\"ukraine\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579824",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "782916fb-03de-4cc2-8af1-ab725b0c1f94",
        "value": "194.156.103.193",
        "Tag": [
          {
            "colour": "#b8cc18",
            "local": false,
            "name": "asn:asn=\"215540\"",
            "relationship_type": ""
          },
          {
            "colour": "#c38d7e",
            "local": false,
            "name": "asn:as-owner=\"GCS-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP addresses",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579845",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b8b70fe2-c7b2-4654-b44c-46dd95ab822b",
        "value": "37.120.247.228",
        "Tag": [
          {
            "colour": "#64bed2",
            "local": false,
            "name": "asn:asn=\"9009\"",
            "relationship_type": ""
          },
          {
            "colour": "#41c276",
            "local": false,
            "name": "asn:as-owner=\"M247\"",
            "relationship_type": ""
          },
          {
            "colour": "#26f3a1",
            "local": false,
            "name": "asn:as-country=\"RO\"",
            "relationship_type": ""
          },
          {
            "colour": "#026417",
            "local": false,
            "name": "misp-galaxy:country=\"romania\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP addresses",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579866",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ff435918-053b-498c-bacf-b6d5fdea82d1",
        "value": "64.226.124.190",
        "Tag": [
          {
            "colour": "#c2074e",
            "local": false,
            "name": "asn:asn=\"14061\"",
            "relationship_type": ""
          },
          {
            "colour": "#d7952a",
            "local": false,
            "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP addresses",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579887",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9c23decc-5738-4f62-bafe-76676afaa366",
        "value": "104.248.134.194",
        "Tag": [
          {
            "colour": "#c2074e",
            "local": false,
            "name": "asn:asn=\"14061\"",
            "relationship_type": ""
          },
          {
            "colour": "#d7952a",
            "local": false,
            "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP addresses",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579908",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "516129f2-f8c6-4eb1-be85-39ed727906ee",
        "value": "193.238.152.66",
        "Tag": [
          {
            "colour": "#c323de",
            "local": false,
            "name": "asn:asn=\"15626\"",
            "relationship_type": ""
          },
          {
            "colour": "#31e258",
            "local": false,
            "name": "asn:as-owner=\"GF-UA\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP addresses",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579929",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c0490225-b0b6-4a6c-aa90-09fcbd90c8d7",
        "value": "216.252.238.18",
        "Tag": [
          {
            "colour": "#3b4764",
            "local": false,
            "name": "asn:asn=\"40676\"",
            "relationship_type": ""
          },
          {
            "colour": "#e503ce",
            "local": false,
            "name": "asn:as-owner=\"AS40676\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP addresses",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579950",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "d9bb9842-c2d0-436e-b642-14c46879b77b",
        "value": "216.252.238.64",
        "Tag": [
          {
            "colour": "#3b4764",
            "local": false,
            "name": "asn:asn=\"40676\"",
            "relationship_type": ""
          },
          {
            "colour": "#e503ce",
            "local": false,
            "name": "asn:as-owner=\"AS40676\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP addresses",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785579971",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b41d7b4e-acca-449e-a779-7fcf3a749266",
        "value": "216.252.238.104",
        "Tag": [
          {
            "colour": "#3b4764",
            "local": false,
            "name": "asn:asn=\"40676\"",
            "relationship_type": ""
          },
          {
            "colour": "#e503ce",
            "local": false,
            "name": "asn:as-owner=\"AS40676\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}