Russian hackers exploited Zimbra zero-day in espionage campaigns

Russian state-sponsored cybercriminals exploited a zero-day vulnerability in the Zimbra email and collaboration platform to conduct espionage against Western targets, primarily military and government agencies, according to a recent report by Tech Radar.

Proofpoint reports that the threat group TA488, also known as Laundry Bear or Void Blizzard, leveraged a cross-site scripting (XSS) vulnerability, tracked as CVE-2025-66376, in Zimbra's web-based email service. This "half-click exploit" allowed attackers to compromise systems simply when victims viewed malicious emails, without requiring any further interaction. The campaign targeted NATO, Ukrainian government organizations, and entities within the defense industrial base. After gaining access, TA488 exfiltrated emails, passwords, two-factor authentication tokens, and other sensitive information. The group consistently targeted these entities for at least a year before their activity ceased in February 2026, following the public disclosure of their methods by security researchers, which led to their disappearance.

Source: Tech Radar