[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLnxk7Monc7dPulkzTiXS_Un6DHkwRZXN7VWSZxd5ChQ":3},{"article":4,"iocs":52,"watch_terms":61,"solutions":62,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"bea57ac4-a4aa-477c-99d2-7015d0169ad1","Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes","russian-espionage-group-exploited-zimbra-zero-day-to-steal-mail-and-2fa-codes-5518fb","A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor recovery. Opening the message was enough to start it. The NSA, CISA and partner agencies published","A Russian state-sponsored group, identified as TA488, exploited a zero-day vulnerability (CVE-2025-66376) in Zimbra's webmail client to steal emails, 2FA recovery codes, and browser-saved passwords. The attack, active since at least July 2025, targeted government and commercial organizations in NATO states, Ukraine, CIS, Africa, and the US, including nuclear installations. The vulnerability allowed for code execution simply by viewing a malicious email.","Russian espionage group exploited a Zimbra zero-day to steal mail and 2FA codes.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Frussian-espionage-group-exploited.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjzlA3Ln3fk8yzrfLwR9egB99u67BL7NlRui9XkKviyXhFmZ3sYVTF5laSjHTwyphN51YvL39R0irNNPn2hDpVcn6EFi_NmuuSH3XTS9I71aPdZvgZRTOxXczmyqbSkcpqSy2TgOzSSJ0RzAyeQA4YXED73kIChZFtiuZ1fIVzCFvDJK4bEJ5M6Sj-qPeI\u002Fs1600\u002Fzimbra-email.jpg","2026-07-23T18:36:08+00:00","2026-07-23T20:00:14.902645+00:00",9,[17,20,23,26],{"name":18,"type":19},"TA488","threat_actor",{"name":21,"type":22},"Zimbra Collaboration","product",{"name":24,"type":25},"CL-STA-1114","campaign",{"name":27,"type":28},"Zimbra","vendor","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":29,"icon":31,"name":32,"slug":33},null,"Zero-day","zero-day",[35,37,42,47],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57],{"type":54,"value":55,"context":56},"cve","CVE-2025-66376","Zimbra stored cross-site scripting vulnerability",{"type":58,"value":59,"context":60},"malware","ZimReaper","JavaScript payload used by TA488",[27,21],{"controls":63,"vendors":145},[64,93,119],{"slug":65,"name":66,"problem":67,"products":68},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":115,"product_name":116,"url":117,"description":118},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":120,"name":121,"problem":122,"products":123},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":141,"product_name":142,"url":143,"description":144},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[146,152],{"slug":147,"name":148,"logo_path":149,"roles":150},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[151],"reported_by",{"slug":153,"name":154,"logo_path":155,"roles":156},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png",[151],{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":174},"russian-spies-exploit-zimbra-zero-day-to-harvest-emails-and-2fa-codes","Russian Spies Exploit Zimbra Zero-Day to Harvest Emails and 2FA Codes","A Russian state-sponsored threat actor (TA488) exploited an unpatched zero-day vulnerability (CVE-2025-66376) in Zimbra's webmail client, enabling code execution simply by rendering a malicious email — requiring no user interaction beyond opening the message. The attack exposed highly sensitive data including emails, two-factor authentication recovery codes, and browser-saved passwords from government bodies, commercial organizations, and nuclear installations across multiple continents. Zero-day exploits are particularly dangerous because no patch exists at the time of initial exploitation, leaving defenders reliant on compensating controls and rapid detection. This incident underscores the critical risk of centralizing sensitive communications and credentials within internet-facing webmail platforms without layered defenses. The targeting of 2FA recovery codes is especially alarming, as it effectively neutralizes a key authentication safeguard and enables long-term persistent access.",[162,163,164,165,166,167,168,169,170,171,172,173],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 6: Access Control Management","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SP 800-63B: Digital Identity Guidelines (MFA)","NIST IR-6: Incident Reporting","NIST SI-2: Flaw Remediation","NIST SC-28: Protection of Information at Rest","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1539: Steal Web Session Cookie","GDPR Article 32: Security of Processing","ITIL Problem Management: Known Error and Workaround Procedures",{}]