Russian APT Exploits Zimbra XSS Vulnerability to Target Ukrainian Government

Key Takeaways

• A Russian state-sponsored threat actor, APT28 (Fancy Bear), has targeted a Ukrainian government agency.
• The attack, dubbed “Operation GhostMail,” exploited a Zimbra XSS vulnerability (CVE-2025-66376) to steal credentials and sensitive email data.
• The campaign was notable for its fileless nature, relying solely on a hidden JavaScript payload within a phishing email.
• The vulnerability was patched in Zimbra Collaboration Suite (ZCS) versions 10.0.18 and 10.1.13 in November 2025.

A sophisticated cyber operation, attributed to a Russian state-linked advanced persistent threat (APT) group, has successfully compromised a Ukrainian government entity. This campaign leveraged a cross-site scripting (XSS) flaw in the Zimbra Collaboration Suite to illicitly obtain user credentials and sensitive email communications.

Dubbed “Operation GhostMail,” this attack is particularly noteworthy for its stealth. Unlike many conventional cyber intrusions, it completely eschewed common indicators such as malicious file attachments, suspicious hyperlinks, or macro-enabled documents.

The Phishing Vector and Target

The infiltration began with a phishing email dispatched on January 22, 2026, to the Ukrainian State Hydrology Agency. This organization, critical to national infrastructure, operates under Ukraine’s Ministry of Infrastructure.

Crafted in Ukrainian, the email masqueraded as a routine internship inquiry. It purported to be from a fourth-year student at the National Academy of Internal Affairs (NAVS). The message was carefully worded to appear innocuous, even including an apology for potentially reaching the wrong recipient—a classic social engineering tactic designed to lower a victim’s guard.

Seqrite researchers brought this campaign to light after the malicious email was uploaded to VirusTotal on February 26, 2026. At the time of its upload, the email registered zero detections by antivirus engines.

The core of the attack was a substantial base64-encoded JavaScript payload, meticulously hidden within a display:none div block in the email’s HTML body.

This exploit specifically targeted CVE-2025-66376, a stored XSS vulnerability present in the Zimbra Collaboration Suite. This flaw, which involved inadequate sanitization of HTML content utilizing CSS @import directives, was subsequently addressed in Zimbra Collaboration Suite (ZCS) versions 10.0.18 and 10.1.13 in November 2025. When a victim opened the email using Zimbra’s Classic UI while an authenticated session was active, the malicious payload executed silently within their browser.

Attribution to APT28 (Fancy Bear)

Based on technical commonalities with previously documented Zimbra exploits and the geopolitical significance of the target, Seqrite attributed Operation GhostMail to APT28 (Fancy Bear) with medium confidence. The targeting of a Ukrainian government agency responsible for maritime and hydrological infrastructure aligns with known patterns of Russian state-sponsored cyber operations against public sector institutions amidst the ongoing conflict.

Upon execution, the payload silently harvested a wealth of sensitive information. This included session tokens, login credentials, backup two-factor authentication (2FA) codes, browser-saved passwords, and up to 90 days of the victim’s email archives. Critically, these actions transpired without triggering any alerts. Data exfiltration occurred via both HTTPS and DNS channels, significantly complicating detection through traditional network filtering mechanisms.

Two-Stage Infection Mechanism

The attack unfolded through a meticulously designed two-stage process, operating entirely within the victim’s browser and leaving no traces on disk.

Stage 1: JavaScript Loader

In the initial stage, a JavaScript loader first verified the absence of a script with the ID “zmb_pl_v3_” to prevent redundant injections. It then proceeded to decode a base64 payload using the atob() function, followed by XOR decryption with the key “twichcba5e” to reveal the final JavaScript payload. This decoded script was injected into the top-level document, effectively bypassing the webmail’s iframe sandbox and granting it full access to the browser’s cookies, localStorage, and same-origin SOAP API rights.

Stage 2: Browser Stealer

The second stage introduced the full browser stealer. This component began by generating a unique 12-character alphanumeric token for each victim, which served as an identifier in all subsequent command-and-control (C2) requests. The hardcoded C2 domain, zimbrasoft[.]com[.]ua, was notably registered on January 20, 2026—just two days prior to the arrival of the phishing email. Nine parallel data-collection operations were launched simultaneously to maximize data extraction within a single browser session.

These operations captured email content, server configuration details, Cross-Site Request Forgery (CSRF) tokens, mobile device profiles, OAuth application access tokens, backup 2FA codes, and browser-autofilled credentials. The attack also stealthily enabled IMAP access on the victim’s account and created a persistent app-specific password named “ZimbraWeb.” This afforded the attacker long-term mailbox access, even surviving a full password reset.

What You Should Do

• Immediately upgrade Zimbra Collaboration Suite installations from version 8.8.15 to at least version 10.1.x to patch CVE-2025-66376.
• Administrators should audit all user accounts for app-specific passwords named “ZimbraWeb” and revoke them without delay.
• Implement SOAP API monitoring, paying close attention to calls like GetScratchCodesRequest and CreateAppSpecificPasswordRequest, which are unusual in normal usage and warrant immediate investigation.
• Enforce robust DNS filtering to block communication with identified Indicator of Compromise (IOC) domains, including zimbrasoft[.]com[.]ua.
• Disable IMAP or POP3 access for user accounts that do not have a clear business requirement for these protocols.
• Educate staff on the evolving nature of phishing attacks, emphasizing that emails appearing clean, without attachments or external links, can still carry malicious payloads hidden within their HTML structure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.