APT28 GhostMail abuse of Zimbra Classic UI flaw

**CVE-2025-66376** affects **Zimbra Collaboration Suite (ZCS)**, where a stored **XSS flaw** in the **Classic UI** is **actively exploited** and can put exposed mail servers and user sessions at risk. Remote unauthenticated attackers can abuse **CSS @import directives** in email HTML to trigger the weakness, with potential follow-on impacts including session hijacking and sensitive-data theft. The issue was **patched in early November**, but unremediated deployments remain exposed.

**APT28**’s **Operation GhostMail** is actively targeting **Ukrainian government entities** through a phishing chain that exploits **CVE-2025-66376** in **Zimbra Collaboration Suite**, creating immediate risk to email accounts and credentials. The message delivers an obfuscated **JavaScript** payload in the **HTML body** of a single email, avoiding attachments and macros. The payload can harvest **session tokens**, backup **2FA codes**, browser-saved passwords, and mailbox content from the last **90 days**. The activity matters because the vulnerability is already treated as exploited in the wild, and one named target is the **Ukrainian State Hydrology Agency**, a critical infrastructure entity.

**CISA** told **FCEB agencies** to patch **two actively exploited vulnerabilities** in **Synacor Zimbra Collaboration Suite (ZCS)** and **Microsoft Office SharePoint**, creating immediate risk for government collaboration systems. The directive covers **CVE-2025-66376** in ZCS and **CVE-2026-20963** in SharePoint, with deadlines of **March 23, 2026** and **April 1, 2026**. Public reporting does not identify the attackers or the scale of exploitation, but both flaws are already fixed and require prompt remediation.