Russian State Hackers Exploited Zimbra Zero-Day to Steal Email and 2FA Codes

What Happened

A Russian state-sponsored espionage group exploited a previously unknown vulnerability in Zimbra's webmail client to maintain silent, persistent access to Western organizations' inboxes for months before the flaw was discovered. According to The Hacker News, the attackers deployed a payload with surgical precision: it exfiltrated the last 90 days of the victim's email, the organization's complete email directory, any passwords saved in the browser, and active 2FA codes.

Because this was a zero-day — no patch existed at the time of exploitation — defenders had no opportunity to close the gap before attackers walked through it. The campaign targeted Western governments, contractors, and organizations aligned with adversary intelligence priorities.

Why It Matters

The 2FA theft is what sets this apart from a standard credential-harvesting campaign. Organizations that enforced multi-factor authentication may still have been fully bypassed: the payload grabbed live TOTP codes, not just passwords, giving attackers real-time authentication capability alongside the static credentials.

The exfiltration of the full organizational email directory is the other detail that demands attention. Even if attackers no longer have active access, they now hold a precise map of your internal structure — roles, names, addresses — purpose-built for follow-on spear phishing against your employees, partners, and customers. Expect targeted, convincing lures in the weeks ahead if your organization was in scope.

The dwell time matters too. This was months of silent access, not a smash-and-grab. Sensitive communications from that entire window — contract negotiations, incident response discussions, personnel decisions, API credentials shared over email — may all be in adversary hands.

What To Do

If your organization runs Zimbra Collaboration (self-hosted or via a managed provider), treat this as an active incident until confirmed otherwise:

1. Patch immediately. Confirm you are on the latest Zimbra release. Check Zimbra's Security Center for the CVE linked to this zero-day and verify it is closed in your deployed version.

1. Audit webmail logs. Review /opt/zimbra/log/ for unusual session activity, logins from unfamiliar IPs, or anomalous data transfer volumes during the suspected exposure window.

1. Invalidate all active sessions. Force a global logout to kill any sessions an attacker may still hold. Use the Zimbra admin console per-account or zmprov CLI for bulk invalidation.

1. Force organization-wide password resets. Browser-saved passwords are in scope. Assume any credential a Zimbra user has typed into that browser is compromised.

1. Rotate any credentials visible in email. API keys, VPN tokens, service passwords — if it was sent via email during the 90-day exposure window, rotate it now.

1. Preserve logs before remediation. If you suspect active compromise, snapshot logs before any cleanup activity overwrites forensic evidence.

1. Brief users on elevated phishing risk. With a full directory exfiltrated, your staff should expect highly targeted, convincing pretexts in the near term. This is the time to push an internal alert.

If you use a third-party Zimbra hosting provider, contact them immediately to confirm patch status and request a log review for your tenant.