Tag: spypress.zimbra

2 Attack Reports | 0 Vulnerabilities

Attack reports

Operation GhostMail: Russian APT Exploits Zimbra XSS to Target Ukraine Government

A sophisticated phishing campaign targeting a Ukrainian government agency exploits a cross-site scripting vulnerability in Zimbra Collaboration Suite. The attack, attributed to a Russian APT group, uses a seemingly innocuous internship inquiry email to deliver a malicious JavaScript payload. When o…
phishing
russia
ukraine
exfiltration
government
xss
webmail
spypress.zimbra
CVE-2025-66376
2026-03-17
browser-stealer
soap api
zimbra
Published: March 17, 2026
Linked vulnerabilities : CVE-2025-66376 (CVSS 7.2)
Downloadable IOCs: 0

Operation RoundPress targeting high-value webmail servers

ESET researchers have uncovered a Russia-aligned espionage operation named RoundPress, targeting high-value webmail servers through XSS vulnerabilities. The campaign, attributed to the Sednit group, aims to steal confidential data from specific email accounts. Initially focused on Roundcube in 2023…
espionage
spearphishing
russia
zero-day
credential theft
xss
data exfiltration
CVE-2024-27443
CVE-2024-11182
2025-05-15
2025-05-18
webmail
eastern europe
spypress.roundcube
spypress.mdaemon
CVE-2023-43770
spypress.zimbra
spypress.horde
Published: May 18, 2025
Linked vulnerabilities : CVE-2024-27443, CVE-2024-11182 (CVSS 6.1), CVE-2020-35730, CVE-2023-23397, CVE-2023-43770
Downloadable IOCs: 16
Click here to see more Attack Reports