Back Cybersecuritynews

Russian APT Exploits Zimbra XSS to Target Ukrainian Government in ‘Operation GhostMail’

Cybersecuritynews •Tushar Subhra Dutta • March 20, 2026

A Russian state-linked threat actor has launched a targeted cyberattack against a Ukrainian government agency, exploiting a cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite to steal credentials and sensitive email data. Dubbed “Operation GhostMail,” the campaign stands out for its complete absence of traditional attack indicators — no malicious file attachments, no suspicious links, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian APT Exploits Zimbra XSS to Target Ukrainian Government A Russian state-linked advanced persistent threat (APT) has targeted a Ukrainian government agency through a cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite, identified as CVE-2025-66376. The attack, named 'Operation GhostMail,' involves running scripts via HTML emails to extract credentials and sensitive data without traditional indicators of compromise. The vulnerability was published on January 5, 2026, and was added to the CISA Known Exploited Vulnerabilities catalog on March 18, 2026, indicating active exploitation. This campaign highlights the increasing sophistication of state-sponsored cyber operations aimed at Ukraine amidst ongoing geopolitical tensions. The attack's impact is significant, as it compromises sensitive government communications and data security. 4 sources 78

Extracted Entities

Russian APT Exploits Zimbra XSS to Target Ukrainian Government in ‘Operation GhostMail’

The full story

Extracted Entities

Campaigns (1)

Industries (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)