Zimbra: Russian APT exploits stored XSS to siphon mailbox data
Context and Chronology
Security teams observed a high-impact client-side vulnerability in the Classic web UI of Zimbra, which allows crafted HTML to trigger active scripting when a message is opened. Attackers chained cascading style sheet references and embedded script to run in-browser, enabling silent credential and token theft and broad mailbox scraping. The flaw is cataloged as CVE-2025-66376 with a severity score of 7.2, and vendor fixes appear in release builds 10.1.13 and 10.0.18; administrators are urged to apply those updates immediately via the Zimbra advisory.
Federal authorities moved swiftly: CISA listed the vulnerability in its Known Exploited Vulnerabilities roster and invoked accelerated mitigation timelines under existing directives, forcing a two-week patch window for affected systems. Security firm telemetry ties the exploitation trail to a state-linked actor that has targeted Ukrainian networks, and a focused phish sent to a maritime infrastructure organization on January 22 provides an operational example. Observers report that the malicious payload harvests credentials, session tokens, backup two-factor codes, stored passwords, and up to ninety days of mailbox items, then exfiltrates data over DNS and HTTPS channels.
This incident follows an earlier chain of Zimbra-focused intrusions and proof-of-concept disclosures that have repeatedly attracted opportunistic and intelligence-driven attackers; the vendor’s webmail components have been a recurring target in recent months. Response activity is concentrated on patch management, mail filtering policy adjustments, and rapid validation of backup and 2FA recovery secrets. Organizations using mixed on-premises and hosted Zimbra deployments face divergent remediation paths that can complicate uniform timelines and expose slower environments to prolonged risk.
Tactical indicators include weaponized HTML messages originating from likely compromised academic accounts, use of external CSS imports to smuggle executable content, and obfuscated JavaScript that triggers on client render. The campaign has been labeled Operation GhostMail by one vendor and attributed to APT28 (aliases: Sofacy, Fancy Bear) by analysts tracking state-linked activity. Defenders should prioritize patching, enforce stricter email sanitization at gateway layers, and validate session token revocation across affected tenants to limit post-exploitation dwell.
Broader context: the Zimbra KEV listing and two-week federal deadline sit alongside other recent CISA emergency listings of actively exploited management and legacy-service bugs — for example, the SolarWinds Web Help Desk remote-code-execution fix (WHD 2026.1) and several management-console flaws adopted into KEV in the same time window. That pattern compresses patching timelines and forces organizations to reprioritize work, often pushing emergency updates ahead of routine change-control windows. The operational lesson is consistent: when client-facing or management tooling can be weaponized, attackers rapidly convert those surfaces into reliable entry points or persistent data collection channels.
Practical mitigations beyond patching include immediate network-level compensations: restrict public access to webmail and administration ports via ACLs and firewall rules, isolate management and webmail consoles behind VPNs or jump hosts, and apply temporary ingress/egress filtering to block known exfiltration destinations. Detection and hunting should focus on message metadata and client-render events (e.g., external CSS @import requests from unusual domains), anomalous outbound DNS queries and HTTPS connections consistent with data staging, unexpected session token refreshes, and signs of credential replay elsewhere in the environment. Organizations should also rotate session tokens and 2FA backup secrets for exposed accounts and confirm integrity of backups before reconstitution.
Longer-term defenses require architectural changes: stronger gateway disarmament/sanitization of HTML emails, tighter client-side rendering controls, enforced least-privilege for mail administration, and automating patch verification within change control so that emergency updates no longer produce blind spots. Given the mix of hosted and on-prem Zimbra deployments, response plans should explicitly align timelines and compensating controls so slower-managed environments are not left dangerously exposed during the federal remediation window.
Read Our Expert Analysis
Create an account or login for free to unlock our expert analysis and key takeaways for this development.
By continuing, you agree to receive marketing communications and our weekly newsletter. You can opt-out at any time.
Recommended for you
Critical SolarWinds Web Help Desk Flaw Exploited; CISA Orders Rapid Patching
A critical unauthenticated remote code execution bug in SolarWinds Web Help Desk (WHD) rooted in AjaxProxy deserialization is being exploited in the wild and was added to CISA’s Known Exploited Vulnerabilities list, triggering compressed federal remediation deadlines. The listing arrived alongside other high-priority KEV additions this patch cycle, reinforcing that administrative consoles and legacy proxy components are high-risk and require immediate patching and network controls.
Former Trenchant Executive Admitted Selling Eight Zero‑Day Exploits to Russian Broker, DOJ Says
A former Trenchant general manager pleaded guilty to selling eight stolen zero‑day exploits to a Russian exploit broker, netting about $1.3 million in cryptocurrency. U.S. prosecutors say the tools could have enabled access to millions of devices and are seeking heavy penalties, including nine years in prison and $35 million in restitution.
Salt Typhoon hackers believed to be retaining stolen telecom data for later exploitation
An FBI cyber official warned the China-linked group Salt Typhoon likely preserved exfiltrated telecom records as a long-term intelligence cache rather than for immediate monetization. Investigators say the intrusion touched dozens of providers and may involve data tied to more than one million U.S. residents, heightening risks from future targeted surveillance and fraud.
Chinese-linked APT exploits zero-day and rootkits against Singapore telcos
A China-linked advanced persistent threat group targeted all four major Singapore telecommunications operators last year, using a firewall zero-day and rootkits to gain limited footholds. Authorities report no service outages or confirmed data theft so far, and are coordinating containment, remediation, and strengthened monitoring across the sector.
Google: Multiple APTs and crime syndicates widely exploited a critical WinRAR flaw
Google Threat Intelligence Group says a high-severity WinRAR vulnerability (CVE-2025-8088) has been actively abused for months by both nation-state actors and financially motivated groups. Attackers leveraged crafted RAR archives and hidden alternate data streams to place persistent payloads — affecting government, military, technology, travel, and banking targets globally.
Microsoft pushes urgent Office patch for a newly exploited zero-day used in targeted intrusions
Microsoft released fixes for CVE-2026-21509 after detecting active exploitation that undermines Office protections; mitigations and patches cover major supported Office builds and CISA has flagged the flaw for immediate remediation. The vulnerability appears to be leveraged in focused operations requiring user interaction and complex exploit chains, elevating the priority for high-value targets to deploy updates quickly.
React2Shell: Rapid, Large-Scale Exploitation Delivers Reverse Shells and XMRig Miners
A critical unauthenticated remote-execution flaw in React 19 (CVE-2025-55182) has been aggressively exploited, producing over 1.4 million attack attempts in a week and resulting in reverse shells and cryptocurrency-mining deployments. Defenders should combine urgent patching with network containment, WAF protections, and targeted hunts for post-exploitation artifacts while also checking exposed developer tooling and dependency integrity to reduce secondary attack surfaces.
VMware Aria Operations Exploited; CISA Adds CVE-2026-22719 to KEV
A high-severity, unauthenticated command-injection flaw, CVE-2026-22719 , is being exploited against VMware Aria Operations , and CISA has added it to the Known Exploited Vulnerabilities catalog with a federal remediation mandate. This event is one of several recent management-plane and remote‑access vulnerabilities (e.g., SolarWinds WHD, BeyondTrust) that have been weaponized quickly after disclosure, compressing patch windows and forcing urgent compensating controls.