Russian APT targets Ukraine via Zimbra XSS flaw CVE-2025
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-66376 | Stored Cross-Site Scripting in Synacor Zimbra Collaboration Suite Classic UI | 6.1 | 20% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | js-26tik3egye4.i.zimbrasoft.com.ua | ith two domains: js-l1wt597cimk[.]i[.]zimbrasoft[.]com[.]ua js-26tik3egye4[.]i[.]zimbrasoft[.]com[.]ua Historical patterns show Russian APTs like Fancy Be |
| domain | js-l1wt597cimk.i.zimbrasoft.com.ua | infrastructure was set up on 20 Jan 2026 with two domains: js-l1wt597cimk[.]i[.]zimbrasoft[.]com[.]ua js-26tik3egye4[.]i[.]zimbrasoft[.]com[.]ua Historic |
From the original article
2 min read at securityaffairs.com
Russian APT exploits a critical XSS flaw in Zimbra, tracked as CVE-2025-66376, running scripts via HTML emails to target users in Ukraine. Russia-linked threat actor exploits a high-severity XSS vulnerability, tracked as CVE-2025-66376 (CVSS score of 7. 2), in Zimbra Collaboration.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.