Russian APT28 Exploits Zimbra Flaw in Stealthy Phishing Attack on Ukrainian Agency A Russian state-backed hacking group, APT28 (also known as Fancy Bear), targeted Ukraine’s State Hydrographic Service in a sophisticated phishing campaign exploiting a cross-site scripting (XSS) vulnerability in Zimbra webmail. The attack, uncovered by cybersecurity firm Seqrite, leveraged CVE-2025-66376 to inject malicious code into an email’s HTML body, bypassing traditional security measures. Unlike conventional phishing attempts, the email contained no malicious attachments or links. Instead, it appeared as a routine internship inquiry in Ukrainian, with the exploit embedded directly in the message. When opened in an active Zimbra session, the code executed silently, enabling attackers to harvest login credentials, session tokens, backup 2FA codes, stored passwords, and up to 90 days of mailbox data. The malicious email was sent in January 2025 from a compromised student account. By exploiting a trusted webmail environment, APT28 evaded detection, intercepting authenticated sessions without deploying malware or triggering standard defenses. APT28, linked to Russia’s military intelligence, has a history of targeting Ukrainian and Western government entities, defense contractors, and logistics networks. Recent research also tied the group to operations involving new malware strains, BadPaw and MeowMeow. Zimbra webmail has been a recurring target for Russian-linked groups, including APT29 and Winter Vivern, in espionage campaigns across Eastern Europe.