OTX Threat: Zimbra Mailservers Targeted with Half-Click Exploits

Russian-aligned threat actor TA488, also known as Void Blizzard and Laundry Bear, exploited a previously unknown vulnerability in Zimbra Collaboration Suite mailservers for at least five months during 2025. The vulnerability, later assigned CVE-2025-66376, was leveraged through half-click exploits embedded in HTML emails that executed upon opening without requiring user interaction. Upon successfu CVEs: CVE-2025-66376 Sectors: Government, Defense, Energy