Tag
Russian State-Backed 'LAUNDRY BEAR' Exploits Zimbra Zero-Click Vulnerability
3 TTPsThe Russian state-supported threat group LAUNDRY BEAR is exploiting a zero-click vulnerability, dubbed 'beehive,' in the Zimbra Collaboration Suite (ZCS) webmail service, actively stealing sensitive emails and gaining persistent access to compromised networks since July 2025 by merely viewing a malicious email, with Western organizations across various sectors being targeted.
TA488 Exploits Zimbra Mailservers with Half-Click Vulnerability CVE-2025-66376
2 rules 9 TTPs 3 CVEs 7 IOCsRussia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.
Multiple Vulnerabilities in Synacor Zimbra
5 TTPsAn attacker can exploit multiple vulnerabilities in Synacor Zimbra to execute arbitrary code, perform cross-site scripting attacks, bypass security measures, disclose confidential information, and carry out unauthorized actions.
Critical XSS Vulnerability in Synacor Zimbra Collaboration
1 TTPA critical cross-site scripting (XSS) vulnerability, affecting Synacor Zimbra Collaboration versions prior to 10.1.19, allows an attacker to achieve remote indirect code injection, potentially leading to session hijacking, data exfiltration, or defacement.
Synacor Zimbra Classic Web Client XSS Vulnerability
1 TTPAn unauthenticated remote attacker can exploit a Cross-Site Scripting (XSS) vulnerability in the Synacor Zimbra Classic Web Client, allowing the attacker to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking, data theft, or defacement.
Zimbra Security Advisory Addresses Vulnerabilities in Zimbra Daffodil
2 rulesZimbra released a security advisory on May 28, 2026, addressing unspecified vulnerabilities in Zimbra Daffodil versions prior to v10.1.17, urging users to apply necessary updates.
Operation GhostMail: Russian APT Exploiting Zimbra XSS to Target Ukraine Government
2 rules 1 TTPA Russian APT group is exploiting a Zimbra XSS vulnerability (details unspecified) to target the Ukrainian government in an operation dubbed 'GhostMail'.
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
2 rules 1 TTP 1 CVEA cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS) could allow attackers to execute arbitrary JavaScript within a user's session, potentially leading to unauthorized access to sensitive information.