Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-sponsored threat actor (TA488) exploited an unpatched zero-day vulnerability (CVE-2025-66376) in Zimbra's webmail client, enabling code execution simply by rendering a malicious email — requiring no user interaction beyond opening the message. The attack exposed highly sensitive data including emails, two-factor authentication recovery codes, and browser-saved passwords from government bodies, commercial organizations, and nuclear installations across multiple continents. Zero-day exploits are particularly dangerous because no patch exists at the time of initial exploitation, leaving defenders reliant on compensating controls and rapid detection. This incident underscores the critical risk of centralizing sensitive communications and credentials within internet-facing webmail platforms without layered defenses. The targeting of 2FA recovery codes is especially alarming, as it effectively neutralizes a key authentication safeguard and enables long-term persistent access.