Recent intelligence highlights a dual-threat landscape combining high-volume cybercrime and targeted espionage. While the disruption of the Tycoon2FA Phishing-as-a-Service (PhaaS) platform led to a 92% drop in specific phishing volume, threat actors have quickly pivoted to QR code phishing and adversary-in-the-middle (AiTM) attacks, sustaining over 7.6 billion email threats in Q2 2026 alone.
Simultaneously, a distinct Russian-aligned threat actor, Void Blizzard (overlapping with Laundry Bear), is conducting a persistent cyberespionage campaign (CL-STA-1114) against Ukrainian and NATO entities. This group is actively exploiting CVE-2025-66376, a critical vulnerability in Zimbra webmail, utilizing zero-click phishing and JavaScript injection techniques to compromise government and defense sectors.
Threat Actor / Malware Profile
Void Blizzard (CL-STA-1114)
- Classification: Nation-State / APT (Russian-aligned)
- Objective: Cyberespionage and data exfiltration from government, defense, and transportation sectors.
- Attack Vector: Exploitation of CVE-2025-66376 in Zimbra collaboration servers. Techniques include zero-click phishing and malicious JavaScript injection.
- Infrastructure: Uses domains mimicking analytics and metadata services (e.g.,
zimbra-metadata.com,mailnalysis.com) to blend in with legitimate traffic.
Tycoon2FA (Residual & Evolution)
- Classification: Phishing-as-a-Service (PhaaS)
- Objective: Credential theft and business email compromise (BEC).
- Attack Vector: AiTM phishing kits, QR code phishing, and Captcha-gated pages.
- Evolution: Following Microsoft's disruption, actors are shifting to new infrastructure and tactics, including Microsoft Teams threats and vishing.
IOC Analysis
The provided indicators of compromise (IOCs) reveal a focus on infrastructure masquerading as legitimate services:
- Domains: Threat actors utilize "typosquatting" and "lookalike" domains (e.g.,
compliance-protectionoutlook.de,na.businesshellosign.de) to mimic official Microsoft and SaaS branding. Operationalization requires blocking these at the DNS layer and inspecting TLS certificates for anomalies. - File Hashes (SHA256): Several hashes associated with Q2 phishing campaigns were identified. SOC teams should query EDR solutions for these specific hashes to identify potential successful payload deliveries.
- CVE (CVE-2025-66376): A specific vulnerability identifier for Zimbra. This is a critical patch management indicator for organizations running Zimbra webmail instances.
Detection Engineering
YAML
---
title: Void Blizzard Zimbra Exploitation Network Activity
id: 4f3a2b1c-9d8e-4a5f-b6c7-d8e9f0a1b2c3
description: Detects network connections to known Void Blizzard C2 and infrastructure domains related to Zimbra exploitation.
status: experimental
date: 2026/07/23
author: Security Arsenal
logsource:
product: zeek
service: dns
tags:
- attack.command_and_control
- attack.t1071.004
- cve.2025.66376
detection:
selection:
query:
- '*zimbra-metadata.com'
- '*mailnalysis.com'
- '*analyticemailmeter.com'
- '*zimbrastat.com'
- '*istc-cloud.com'
condition: selection
falsepositives:
- Legitimate administrative access to these specific domains (unlikely given context)
level: critical
---
title: Tycoon2FA & Q2 Phasing Infrastructure Connection
id: 5e4b3c2d-0e9f-5b6a-c7d8-e9f0a1b2c3d4
description: Detects outbound connections to domains associated with Tycoon2FA and recent Q2 2026 phishing campaigns.
status: experimental
date: 2026/07/23
author: Security Arsenal
logsource:
category: network_connection
tags:
- attack.initial_access
- attack.credential_phishing
detection:
selection:
DestinationHostname|contains:
- 'x2mails.com'
- 'acceptable-use-policy-calendly.de'
- 'cocinternal.com'
- 'compliance-protectionoutlook.de'
condition: selection
falsepositives:
- Unknown
level: high
---
title: Suspicious File Execution Known Phishing Payloads
id: 6f5c4d3e-1f0a-6c7b-d8e9-f0a1b2c3d4e5
description: Detects execution of files matching SHA256 hashes identified in Q2 2026 phishing pulses.
status: experimental
date: 2026/07/23
author: Security Arsenal
logsource:
category: process_creation
tags:
- attack.execution
- attack.t1204
detection:
selection:
Hashes|contains:
- '11420d6d693bf8b19195e6b98fedd03b9bcbc770b6988bc64cb788bfabe1a49d'
- '5db1ecbbb2c90c51d81bda138d4300b90ea5eb2885cce1bd921d692214aecbc6'
- 'b5a3346082ac566b4494e6175f1cd9873b64abe6c902db49bd4e8088876c9ead'
condition: selection
falsepositives:
- None
level: critical
kql
// Hunt for Void Blizzard and PhaaS Network Connections
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
"zimbra-metadata.com",
"mailnalysis.com",
"x2mails.com",
"cocinternal.com",
"acceptable-use-policy-calendly.de",
"compliance-protectionoutlook.de",
"na.businesshellosign.de"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend IOCFamily = iif(RemoteUrl has "zimbra", "Void_Blizzard", "PhaaS_Phishing")
powershell
# IOC Hunter: Void Blizzard & PhaaS Domains
# Checks DNS Cache for recent resolutions to malicious infrastructure
$maliciousDomains = @(
"zimbra-metadata.com",
"emailanalytics.com.ua",
"mailnalysis.com",
"analyticemailmeter.com",
"zimbrastat.com",
"x2mails.com",
"acceptable-use-policy-calendly.de",
"cocinternal.com"
)
$dnsCache = Get-DnsClientCache
foreach ($domain in $maliciousDomains) {
$hits = $dnsCache | Where-Object { $_.Entry -like "*$domain*" }
if ($hits) {
Write-Host "[ALERT] IOC Found in DNS Cache: $domain" -ForegroundColor Red
$hits | Format-List Entry, Data, TimeToLive
}
}
Response Priorities
- Immediate: Block all listed domains and file hashes at the perimeter (Firewall, Proxy, Secure Email Gateway). Initiate a hunt for CVE-2025-66376 exploitation attempts on Zimbra servers.
- 24h: Conduct identity verification for users who may have interacted with the identified phishing infrastructure. Check Zimbra logs for JavaScript injection artifacts or unusual admin logins.
- 1 week: Patch Zimbra instances to address CVE-2025-66376. Enhance email filtering to detect QR code phishing and AiTM attempts, specifically those masquerading as Microsoft Teams or Calendly invites.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
darkwebotx-pulsedarkweb-aptvoid-blizzardtycoon2faphishing-as-a-servicezimbracve-2025-66376
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.