Product
TA488 Exploits Zimbra Mailservers with Half-Click Vulnerability CVE-2025-66376
2 rules 9 TTPs 3 CVEs 7 IOCsRussia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.
Roundcube Vulnerability Allows Remote Code Execution
2 rules 1 TTPA remote, authenticated attacker can exploit a vulnerability in Roundcube to execute arbitrary program code, potentially leading to complete system compromise.
FrostyNeighbor Targets Ukraine with Updated PicassoLoader Chain
2 rules 3 TTPs 5 CVEs 16 IOCsThe FrostyNeighbor threat actor is targeting Ukrainian governmental organizations with spearphishing emails containing malicious PDFs that deliver a JavaScript dropper (PicassoLoader) and ultimately a Cobalt Strike beacon.
Roundcube Vulnerabilities Leading to Cross-Site Scripting and Information Disclosure
2 rules 1 TTP 3 CVEsMultiple vulnerabilities in Roundcube allow an attacker to perform a cross-site scripting attack and disclose confidential information.