Back Securityaffairs.Co

Russian APT targets Ukraine via Zimbra XSS flaw CVE-2025

Securityaffairs.Co •Pierluigi Paganini • March 19, 2026

Russian APT exploits a critical XSS flaw in Zimbra, tracked as CVE-2025-66376, running scripts via HTML emails to target users in Ukraine. Russia-linked threat actor exploits a high-severity XSS vulnerability, tracked as CVE-2025-66376 (CVSS score of 7.2), in Zimbra Collaboration. Attackers exploited insufficiently sanitized HTML emails to run scripts when opened, targeting users in Ukraine. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian APT Exploits Zimbra XSS to Target Ukrainian Government A Russian state-linked advanced persistent threat (APT) has targeted a Ukrainian government agency through a cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite, identified as CVE-2025-66376. The attack, named 'Operation GhostMail,' involves running scripts via HTML emails to extract credentials and sensitive data without traditional indicators of compromise. The vulnerability was published on January 5, 2026, and was added to the CISA Known Exploited Vulnerabilities catalog on March 18, 2026, indicating active exploitation. This campaign highlights the increasing sophistication of state-sponsored cyber operations aimed at Ukraine amidst ongoing geopolitical tensions. The attack's impact is significant, as it compromises sensitive government communications and data security. 4 sources 78

Extracted Entities

Russian APT targets Ukraine via Zimbra XSS flaw CVE-2025

The full story

Extracted Entities

Countries (2)

CVEs (1)

Platforms (1)

Vulnerabilities (1)