Russian Global Webmail Espionage
ID: ec1e544f-28fb-599b-9d1a-7a5d474c3e25
STIX ID: report--ec1e544f-28fb-599b-9d1a-7a5d474c3e25
Feed Name: Palo Alto Networks Unit 42
Threat Score
Unit 42 describes an active, state-attributed cyberespionage campaign (CL-STA-1114) that exploits a Zimbra webmail vulnerability (CVE-2025-66376) via zero-click HTML/JavaScript payloads to exfiltrate credentials, 2FA codes, email archives and search histories; the report includes the attack chain, nine C2 IPs and nine domains as IoCs, and remediation guidance for defenders.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.