Loading story…
Russian state-backed actors tracked as Laundry Bear, TA488, and Void Blizzard have conducted zero-click phishing campaigns exploiting CVE-2025-66376 in Zimbra Collaboration Suite webmail deployments. Crafted emails can trigger malicious code execution merely when viewed on vulnerable systems, enabling theft of email correspondence, session tokens, and credentials without requiring a victim to open a link or attachment. Reported targets include Ukrainian government bodies and U.S. defense, nuclear, and research organizations, alongside government, telecommunications, finance, and aerospace entities.
Azerbaijan’s National Cybersecurity Agency warned that Zimbra users have faced these campaigns since July 2025 and that compromised systems could expose sensitive mail data, allow unauthorized account access, and support follow-on intrusions. Organizations should apply Zimbra security updates, monitor for anomalous logins and account changes, revoke active sessions and investigate suspected compromise, preserve backups, and reinforce phishing and social-engineering awareness.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Phishing campaigns targeting organizations using Zimbra Collaboration Suite began in July 2025. The campaigns used crafted emails exploiting CVE-2025-66376, where viewing a message on a vulnerable system could enable malicious-code execution.
Azerbaijan’s National Cybersecurity Agency issued an alert about targeted threats to Zimbra Collaboration Suite users and advised organizations to apply updates for CVE-2025-66376, monitor for suspicious activity, revoke sessions when needed, and investigate suspected compromises.
The UK National Cyber Security Centre issued an advisory concerning the reported zero-click webmail attacks.
The threat actors later adapted their operations to exploit a second, unspecified vulnerability in Outlook Web Access.
The activity, attributed to Laundry Bear (TA488/Void Blizzard), targeted Ukrainian government entities and U.S. defense, nuclear, and research organizations, as well as government, telecommunications, finance, and aerospace sectors. Attackers reportedly stole email correspondence, session tokens, and credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that a cyberespionage campaign tracked as **CL-STA-1114**, overlapping with activity attributed by other vendors to **Void Blizzard** and **LAUNDRY BEAR**, has been exploiting **Zimbra Collaboration Suite** webmail servers at government, defense, transportation, and financial organizations. The activity has affected targets across NATO member states, Ukraine, CIS countries, and Africa, with researchers saying the broader cluster has been active since at least 2024 and Zimbra-focused operations began in July 2025. The attackers used zero-click phishing emails to exploit **`CVE-2025-66376`** in Zimbra webmail, allowing a malicious JavaScript payload to run in victims’ browsers without user interaction. Unit 42 said the malware can steal Zimbra credentials, CSRF tokens, 2FA scratch codes, system details, and up to 90 days of email and search history. Researchers also identified at least nine IP addresses and nine domains tied to command-and-control infrastructure, with servers remaining active for an average of 35.4 days, and warned that unpatched Zimbra instances are being actively targeted.
Aug 25, 2026
**APT28**, the Russia-linked threat group associated with the GRU, used a phishing campaign dubbed *Operation GhostMail* to target Ukrainian government entities by exploiting **Zimbra Collaboration Suite** vulnerability `CVE-2025-66376`. The campaign targeted the **State Hydrographic Service of Ukraine**, a critical infrastructure body supporting maritime navigation and hydrographic operations. The attack used a single email written in Ukrainian and disguised as a routine internship inquiry; instead of relying on attachments or links, the malicious payload was embedded directly in the HTML body and executed when opened in a vulnerable Zimbra webmail session. Researchers said the stored XSS flaw allowed attackers to run obfuscated JavaScript in the victim’s browser, enabling theft of login credentials, session tokens, backup two-factor authentication codes, browser-stored passwords, and up to 90 days of mailbox data. Reporting also notes the flaw was patched in November and later added by **CISA** to its **Known Exploited Vulnerabilities** catalog, with U.S. federal civilian agencies ordered to remediate within two weeks under `BOD 22-01`. The operation stood out for abusing a trusted webmail environment to hijack authenticated sessions without deploying traditional malware, helping the intrusion evade many standard phishing and endpoint defenses.
Jun 29, 2026
Russia-aligned espionage groups **TA458** and **TA488** have been exploiting vulnerabilities in webmail platforms including **Roundcube, Zimbra, SOGo, mDaemon, Kerio,** and **SOGo** to compromise government and defense targets through so-called **"half-click"** attacks, where opening a malicious email in a webmail session triggers attacker-controlled JavaScript. Proofpoint reported TA458 used a **SOGo zero-day** later patched as `CVE-2026-8496`, while TA488 exploited a previously unknown **Zimbra** flaw assigned `CVE-2025-66376` for months. The campaigns targeted Ukrainian government entities, Eastern European military and government organizations, and parts of the U.S. defense industrial base and nuclear sector, with malware such as **SpyPress** and **ZimReaper** stealing credentials, contacts, emails, CSRF tokens, and app-specific passwords to bypass multifactor protections. Reporting on **APT28** infrastructure exposed in early 2026 tied the broader **Operation RoundPress** activity to a larger webmail espionage program that relied heavily on patched but unremediated flaws, including `CVE-2020-35730`, `CVE-2023-43770`, `CVE-2021-44026`, and `CVE-2020-12641` in Roundcube. Researchers said the leaked toolkit included XSS payloads, a Flask-based command-and-control server, a Go implant for GNU/Linux, operator bash history, and victim data, revealing poor operational security and overlap between staging, exfiltration, and pivot infrastructure. TA458 was also observed chaining a Roundcube XSS vector with `CVE-2025-49113` to achieve PHP deserialization and arbitrary code execution, showing that the actors are pursuing not only mailbox theft and forwarding-rule abuse but also persistent server-side access.
Aug 11, 2026