Russian hackers exploit Zimbra flaw in Ukrainian govt attacks

APT28 (Fancy Bear) is actively exploiting a high-severity stored XSS in Zimbra (CVE-2025-66376) to achieve RCE and silently harvest credentials, session tokens, 2FA backup codes, saved passwords, and up to 90 days of mailbox contents from targeted Ukrainian government recipients (Operation GhostMail); CISA has cataloged the vulnerability and ordered remediation while researchers have documented exfiltration over DNS and HTTPS.