Full Report
Hackers part of APT28, a state-backed threat group linked to Russia's military intelligence service (GRU), are exploiting a Zimbra Collaboration Suite (ZCS) vulnerability in attacks targeting Ukrainian government entities. [...]
Analysis Summary
# Threat Actor: APT28
## Attribution & Identity
* **Identification:** A state-backed threat group linked to the **Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU)**.
* **Aliases:** Fancy Bear, Strontium, Forest Blizzard.
* **Associations:** Part of Russia's military intelligence service.
## Activity Summary
* **Campaign Name:** Operation GhostMail (as identified by Seqrite Labs).
* **Current Activity:** Exploitation of a high-severity stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS).
* **Operation Details:** Attackers deliver phishing emails containing no malicious attachments or links; instead, the entire attack chain remains within the HTML body of the email. When a victim opens the message in a vulnerable Zimbra webmail session, a silent JavaScript payload executes.
## Tactics, Techniques & Procedures
* **Phishing:** Use of specially crafted HTML emails designed to trigger exploits upon viewing.
* **Exploitation of Vulnerabilities:** Targeting CVE-2025-66376 (Stored XSS).
* **Execution:** Remote Code Execution (RCE) via JavaScript.
* **Data Exfiltration:** Dual-channel exfiltration using both DNS and HTTPS.
* **Post-Exploitation Actions:**
* Harvesting credentials and session tokens.
* Stealing backup 2FA codes and browser-saved passwords.
* Exfiltrating mailbox contents (targeting a 90-day history).
* **MITRE ATT&CK IDs (Implied):**
* T1566.001 (Phishing: Spearphishing Attachment/Link equivalent via HTML body)
* T1189 (Drive-by Compromise)
* T1203 (Exploitation for Client Execution)
* T1041 (Exfiltration Over C2 Channel)
* T1567 (Exfiltration Over Web Service)
## Targeting
* **Sectors:** Government, Critical Infrastructure, Ministry of Infrastructure.
* **Geography:** Ukraine.
* **Victims:** The Ukrainian State Hydrology Agency.
## Tools & Infrastructure
* **Primary Tool:** Obfuscated JavaScript payload.
* **Software Targeted:** Zimbra Collaboration Suite (ZCS).
* **Infrastructure:**
* Exfiltration via DNS and HTTPS.
* *Note: Specific C2 domains or IPs were not provided in the source text, but common practice involves defanging if present (e.g., example[.]com).*
## Implications
* **Strategic Impact:** APT28 continues to prioritize the compromise of Ukrainian government communications to support Russian military objectives.
* **Technical Impact:** The ability to compromise servers without user interaction beyond opening an email represents a high risk to organizations using on-premise collaboration suites.
* **Trend Analysis:** This follows a pattern of Russian state actors (including APT29/Cozy Bear and Winter Vivern) aggressively targeting "N-day" vulnerabilities in Zimbra to gain persistence within government networks.
## Mitigations
* **Patching:** Immediately update Zimbra Collaboration Suite to version 10.1.13, 10.0.18, or later to remediate **CVE-2025-66376**.
* **FCEB Compliance:** Federal agencies must comply with CISA BOD 22-01 and secure servers within the mandated two-week window.
* **Email Security:** Implement advanced email filtering capable of inspecting HTML bodies for obfuscated JavaScript.
* **Monitoring:** Monitor DNS and HTTPS traffic for unusual spikes or unauthorized exfiltration patterns, particularly originating from mail servers.