Russian TA488 and TA458 Exploit Webmail Vulnerabilities in Espionage Campaigns

### Executive summary Russian-linked actors TA488 and TA458 are actively exploiting webmail server vulnerabilities to target Ukrainian and Eastern European government and military entities: TA488 leverages a half-click exploit against Zimbra (CVE-2025-66376) via compromised accounts, while TA458 is exploiting a SOGo zero-day (CVE-2026-8496). Both campaigns require minimal user interaction, increasing the likelihood of successful espionage operations and posing significant national security risk.