Vulnerabilità · 67 giorni fa
Il punto critico non è un nuovo bug, ma il fatto che la stessa XSS continua a funzionare dopo la correzione. In Zimbra Classic UI basta aprire un messaggio per far partire lo script malevolo; la lettura della casella diventa quindi il punto di compromissione, non un semplice segnale di phishing.
Le agenzie statunitensi e partner europei dicono che Laundry Bear usa CVE-2025-66376 dal luglio 2025 e che il traffico colpisce governo, difesa, education, energia, legale, media e tecnologia. Il gruppo punta a raccogliere email recenti, directory, token MFA e nuovi app passcode, quindi una casella già vista durante la finestra di esposizione va trattata come potenzialmente saccheggiata. Il caso Notepad++ con UAC-0099 è separato e non deve rallentare la triage su Zimbra.
Sfruttamento noto · CISA KEV
CVSS 7.2 HIGH: zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style… EPSS 20% (97º percentile).
Data di correzione federale CISA 1 apr · data superata
13 fonti che coprono questa storia
Russian hackers exploit unpatched Zimbra servers to steal emails - Help Net Security
Laundry Bear exploited a Zimbra Collaboration Suite vulnerability in phishing attacks targeting governments and critical sectors worldwide.
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
CERT-UA links UAC-0099 to a fake Notepad++ plugin that deploys BURNYBEAR and MATCHBOIL.V2, with persistence running every three minutes on Windows.
Risky Bulletin: Western cyber agencies warn of Russian hacks of Zimbra servers
A Russian hacking campaign targets Zimbra servers, the US accuses Moonshot AI of distillation attacks, Iran targets more PLC vendors, and [Read More
Russian Hackers Exploit Zimbra 0-Day Against US, Ukraine Targets
A state-sponsored threat group, dubbed "Laundry Bear," sends "half-click" phishing emails that require a victim only to open or preview the message.
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
Russian spies exploited CVE-2025-66376 in Zimbra to steal 90 days of mail, passwords, 2FA codes, and directories from Western targets.
Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries
and allied officials warn of Russian espionage group Laundry Bear exploiting a Zimbra zero-day vulnerability to steal sensitive email data.
The Record from Recorded Future
International alert spotlights Russia-linked attacks on Zimbra webmail
A Kremlin-backed group known as Laundry Bear has been using a zero-click phishing technique to break into Zimbra webmail accounts worldwide, the U.S.
International alert spotlights Russia-linked attacks on Zimbra webmail
A Kremlin-backed group known as Laundry Bear has been using a zero-click phishing technique to break into Zimbra webmail accounts worldwide, the U.S.
Russian Hackers Exploit New ‘Zero-Click’ Attack
International agencies issue joint alert over state-backed campaign exploiting a critical vulnerability in the Zimbra Collaboration Suite
Russian Global Webmail Espionage
Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials.
Russian hackers exploit Zimbra zero-click flaw for email theft
CISA is warning that the Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is targeting organizations using Zimbra Collaboration email servers by combining phishing attacks with the exploitation of a now-patched Zimbra vulnerability.
Hackers abuse Notepad++ plugins to stealthily install malware
Ukraine's CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence.
Part of the PlainSec briefing for 2026-07-23