Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-supported espionage group exploited a previously unknown vulnerability in Zimbra's webmail client to steal emails, password data, and two-factor authentication recovery codes. The attack, which targeted the last 90 days of email and an organization's directory, was disclosed by the NSA, CISA, and partner agencies.