Russian hackers exploit Zimbra flaw for espionage

Russian state-sponsored cybercriminals have been actively exploiting a critical zero-day vulnerability within the Zimbra email and collaboration platform. This high-severity flaw, identified as CVE-2025-66376, facilitated espionage campaigns against Western targets, primarily military and government agencies. Researchers noted the exploit's effectiveness as a "half-click exploit," requiring victims only to view a malicious email to compromise their systems.

The campaign, led by the group TA488 (also known as Laundry Bear or Void Blizzard), specifically targeted NATO and Ukrainian government organizations, as well as entities within the defense industrial base. Following successful exploitation, TA488 established persistent access to compromised systems to exfiltrate emails, passwords, and other sensitive information. The group's activity appears to have ceased after February 2026, following public disclosure of their methods.

The vulnerability CVE-2025-66376 was patched by Zimbra in November 2025. However, threat actors had been leveraging it for an extended period prior to the patch. The disappearance of TA488 activity post-February 2026 is attributed to security researchers disclosing their infrastructure and operational methods, prompting the group to dismantle their setups.