APT28 Exploits Zimbra XSS Flaw to Breach Ukrainian Government Webmail

APT28, the Russia-linked threat group associated with the GRU, used a phishing campaign dubbed Operation GhostMail to target Ukrainian government entities by exploiting Zimbra Collaboration Suite vulnerability CVE-2025-66376. The campaign targeted the State Hydrographic Service of Ukraine, a critical infrastructure body supporting maritime navigation and hydrographic operations. The attack used a single email written in Ukrainian and disguised as a routine internship inquiry; instead of relying on attachments or links, the malicious payload was embedded directly in the HTML body and executed when opened in a vulnerable Zimbra webmail session.

Researchers said the stored XSS flaw allowed attackers to run obfuscated JavaScript in the victim’s browser, enabling theft of login credentials, session tokens, backup two-factor authentication codes, browser-stored passwords, and up to 90 days of mailbox data. Reporting also notes the flaw was patched in November and later added by CISA to its Known Exploited Vulnerabilities catalog, with U.S. federal civilian agencies ordered to remediate within two weeks under BOD 22-01. The operation stood out for abusing a trusted webmail environment to hijack authenticated sessions without deploying traditional malware, helping the intrusion evade many standard phishing and endpoint defenses.