Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.
PoC
Zimbra Collaboration Suite +10
TA488
+2
espionage
xss
zimbra
apt
state-sponsored
half-click
cve-2025-66376
2r
9t
3c
7i
updated