Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-supported espionage group exploited a previously unknown vulnerability in Zimbra's webmail client to access Western mailboxes for months. The group's payload targeted the last 90 days of email, the entire email directory, saved browser passwords, and two-factor recovery codes. Simply opening a malicious message was sufficient to trigger the payload. The NSA, CISA, and other partner agencies have published information about the incident. The vulnerability allowed the group to steal sensitive information, including emails and authentication codes. The attack highlights the group's ability to exploit unknown flaws to gain unauthorized access to sensitive data.