Operation GhostMail — Campaign Analysis & Threat Activity

Related Threat Clusters

• Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign

  Since July 2025, Russian state-backed hackers, known as Laundry Bear, have exploited a zero-click vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite to infiltrate Western government and commercial…

  82 articles · Updated July 23, 2026
• APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine

  Russian state-backed hackers from APT28 are actively exploiting a high-severity stored cross-site scripting vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite (ZCS) to target Ukrainian government entities.…

  8 articles · Updated March 19, 2026
• Russian APT Exploits Zimbra XSS to Target Ukrainian Government

  A Russian state-linked advanced persistent threat (APT) has targeted a Ukrainian government agency through a cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite, identified as CVE-2025-66376. The…

  4 articles · Updated March 20, 2026

Recent Intelligence Reports

• Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets — Darkreading · July 23, 2026
• Russian APT Exploits Zimbra XSS to Target Ukrainian Government in ‘Operation GhostMail’ — Cybersecuritynews · March 20, 2026
• Russian hackers exploit Zimbra flaw in Ukrainian govt attacks — Bleepingcomputer · March 19, 2026

Related Entities