Vendor
Russian State-Backed 'LAUNDRY BEAR' Exploits Zimbra Zero-Click Vulnerability
3 TTPsThe Russian state-supported threat group LAUNDRY BEAR is exploiting a zero-click vulnerability, dubbed 'beehive,' in the Zimbra Collaboration Suite (ZCS) webmail service, actively stealing sensitive emails and gaining persistent access to compromised networks since July 2025 by merely viewing a malicious email, with Western organizations across various sectors being targeted.
TA488 Exploits Zimbra Mailservers with Half-Click Vulnerability CVE-2025-66376
2 rules 9 TTPs 3 CVEs 7 IOCsRussia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.
Zimbra Security Advisory Addresses Vulnerabilities in Zimbra Daffodil
2 rulesZimbra released a security advisory on May 28, 2026, addressing unspecified vulnerabilities in Zimbra Daffodil versions prior to v10.1.17, urging users to apply necessary updates.
FrostyNeighbor Targets Ukraine with Updated PicassoLoader Chain
2 rules 3 TTPs 5 CVEs 16 IOCsThe FrostyNeighbor threat actor is targeting Ukrainian governmental organizations with spearphishing emails containing malicious PDFs that deliver a JavaScript dropper (PicassoLoader) and ultimately a Cobalt Strike beacon.
CVE-2026-42897 Microsoft Exchange Server Cross-Site Scripting Vulnerability
2 rules 2 TTPs 1 CVE 8 IOCsCVE-2026-42897 is a cross-site scripting (XSS) vulnerability in Microsoft Exchange Server that allows an attacker to perform spoofing attacks by injecting malicious scripts into web pages.