Russian APT Exploits Zimbra XSS In GhostMail Attacks On Ukrainian Government

Seqrite Labs has uncovered a highly targeted phishing campaign dubbed “Operation GhostMail”. The attack compromised the Ukrainian State Hydrology Agency by exploiting a Cross-Site Scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS).

Unlike typical attacks, this campaign relies entirely on the email body, using no malicious attachments, suspicious links, or macros.

Attributed with medium confidence to the Russian state-sponsored group APT28, the operation demonstrates advanced stealth by living exclusively within the victim’s browser.

Vulnerability and Attack Vector

The attack begins with a phishing email disguised as a standard internship inquiry. Sent on January 22, 2026, the message originated from a compromised student account at the National Academy of Internal Affairs (NAVS).

When the victim opens the email in the Zimbra Classic UI, a hidden JavaScript payload executes silently. This exploits CVE-2025-66376, a stored XSS flaw caused by improper sanitization of CSS @import directives, which was patched in November 2025.

To bypass Zimbra’s built-in AntiSamy security filter, the attackers injected noise directly into the HTML tag names.

This allowed the malformed tags to evade regex-based inspections while remaining valid to the browser. Once the browser reconstructs the fragmented code, a Base64-encoded loader executes.

This initial script decodes the final payload, injects it into the top-level document, and escapes the webmail sandbox to inherit the user’s active session context and cookies.’

Stealthy Data Exfiltration

While the payload is active in the browser’s memory, the malware leverages Zimbra’s legitimate SOAP API to perform unauthorized actions.

By extracting the CSRF token from the local storage, the script ensures its requests look identical to normal webmail activity.

The stealer executes nine simultaneous operations to maximize data theft, capturing login credentials, session tokens, backup 2FA recovery codes, and browser-saved passwords.

It also establishes long-term persistence by silently generating an app-specific password and enabling IMAP access on the compromised account.​

The most severe impact is the exfiltration of the victim’s entire mailbox. The seqrite script uses Zimbra’s native export feature to download up to 90 days of emails.

To ensure successful data delivery, the stolen information is sent to the command-and-control (C2) domain, zimbrasoft[.]com[.]ua, using a dual-channel approach.

Large data blobs are sent over HTTPS, while smaller segments are encoded in Base32 and exfiltrated through DNS queries to bypass standard network blocks.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.