Researchers Say APT28 Exploited Zimbra Flaw in Ukrainian Government Attacks
Summary
Seqrite Labs says APT28 exploited Zimbra’s stored XSS flaw CVE-2025-66376 in Operation GhostMail against Ukrainian government entities, harvesting email and account data. CISA added the flaw to its exploited-vulnerability catalog and ordered federal agencies to patch.
Key points
- Seqrite Labs reported that APT28 exploited Zimbra’s stored XSS vulnerability, CVE-2025-66376, in attacks targeting Ukrainian government entities.
- The Ukrainian State Hydrology Agency was identified as a target of the campaign, named Operation GhostMail.
- Researchers said phishing emails carried obfuscated JavaScript in their HTML body, which ran when opened in a vulnerable Zimbra webmail session.
- The researchers said the script harvested credentials, session tokens, backup 2FA codes, browser-saved passwords, and up to 90 days of mailbox contents.
- They reported that the stolen information was exfiltrated over DNS and HTTPS.
- CISA added CVE-2025-66376 to its catalog of vulnerabilities exploited in the wild and directed federal civilian agencies to remediate within two weeks.
- The article says the flaw was patched in early November; it describes the vulnerability as capable of allowing unauthenticated attackers to achieve remote code execution.
Article Details
- Event Type
- APT28 exploited a stored cross-site scripting vulnerability in Zimbra through an HTML-only phishing campaign targeting Ukrainian government entities.
- Impact
- The attack reportedly enabled remote code execution and compromise of Zimbra servers and email accounts. Researchers said the campaign harvested credentials, session tokens, backup 2FA codes, browser-saved passwords, and up to 90 days of mailbox contents, exfiltrating data over DNS and HTTPS.
MITRE ATT&CK
CVE
Threat Actors
APT28Researchers attributed the Operation GhostMail attacks exploiting the Zimbra vulnerability against Ukrainian government entities to APT28, which the article describes as linked to Russia's GRU.Cozy BearThe article identifies Cozy Bear as an alternate name for APT29, which it reports targeted vulnerable Zimbra servers at mass scale in October 2024.Fancy BearThe article identifies Fancy Bear as an alternate name for APT28, which researchers attributed with exploiting the Zimbra vulnerability in attacks against Ukrainian government entities.ICE RELICThe article reports that APT29 targeted vulnerable Zimbra servers at mass scale in October 2024 to steal email account credentials.Midnight BlizzardThe article identifies Midnight Blizzard as an alternate name for APT29, which it reports targeted vulnerable Zimbra servers at mass scale in October 2024.STRONTIUMThe article identifies Strontium as an alternate name for APT28, which researchers attributed with exploiting the Zimbra vulnerability in attacks against Ukrainian government entities.Winter VivernThe article reports that Winter Vivern used a separate reflected XSS exploit to breach Zimbra webmail portals and spy on communications beginning in February 2023.
Products
Countries
RussiaHackers part of APT28, a state-backed threat group linked to Russia’s military intelligence service (GRU), are exploiting a Zimbra Collaboration Suite (ZCS) vulnerability in attacks targeting Ukrainian governmentUkrainethat the Zimbra XSS vulnerability had been exploited by APT28 military hackers in attacks against Ukraine.
Industries
Critical infrastructureThe Ukrainian State Hydrology Agency (a critical infrastructure entity under the Ministry of Infrastructure that provides navigational, maritime, and hydrographic support) was one of the targets of this phishingGovernmentState-sponsored APT28 actors exploited a high-severity Zimbra Collaboration Suite XSS flaw (CVE-2025-66376) to achieve remote code execution and compromise Ukrainian government email servers.