CyberVeille.ch16m ago

📢 APT28 exploite la faille XSS Zimbra CVE-2025-66376 contre des entités ukrainiennes
📝 ## 🗓️ Contexte

Selon un rapport publié par **Seqrite Labs** et relayé par Security Affairs...
📖 cyberveille : https://cyberveille.ch/posts/2026-03-22-apt28-exploite-la-faille-xss-zimbra-cve-2025-66376-contre-des-entites-ukrainiennes/
🌐 source : https://securityaffairs.com/189673/security/russian-apt-targets-ukraine-via-zimbra-xss-flaw-cve-2025-66376.html
#APT28 #CVE_2025_66376 #Cyberveille

APT28 exploite la faille XSS Zimbra CVE-2025-66376 contre des entités ukrainiennes

🗓️ Contexte Selon un rapport publié par Seqrite Labs et relayé par Security Affairs le 19 mars 2026, un groupe APT lié à la Russie — attribué avec une confiance modérée à APT28 (alias Fancy Bear, Sednit, STRONTIUM, UAC-0001) — mène une campagne d’espionnage ciblant des entités gouvernementales ukrainiennes via une vulnérabilité dans Zimbra Collaboration. 🎯 Campagne : Operation GhostMail La campagne, baptisée Operation GhostMail, exploite la vulnérabilité CVE-2025-66376 (CVSS 7.2), un stored XSS dans l’interface Classic UI de Zimbra, causé par une sanitisation insuffisante des directives CSS @import dans le contenu HTML des emails.

CyberVeille
OTX Bot4d ago

Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine

Pulse ID: 69bb260932564fa54536f69f
Pulse Link: https://otx.alienvault.com/pulse/69bb260932564fa54536f69f
Pulse Author: Tr1sa111
Created: 2026-03-18 22:24:09

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT28 #CyberSecurity #InfoSec #OTX #OpenThreatExchange #RAT #UK #Ukr #Ukraine #bot #Tr1sa111

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

LevelBlue Open Threat Exchange
OTX Bot4d ago

Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine

An exposed open directory revealed a comprehensive Roundcube exploitation toolkit used by APT28 to target Ukrainian government entities. The toolkit includes XSS payloads, a Flask-based C2 server, CSS injection tools, and a Go-based implant. It enables credential harvesting, persistent mail forwarding, bulk email exfiltration, address book theft, and 2FA secret extraction. The primary target was identified as mail.dmsu.gov.ua, Ukraine's State Migration Service. Technical analysis shows significant overlaps with previously documented APT28 operations, while introducing new capabilities such as CSS-based side-channel attacks and browser credential theft. The toolkit's modular approach and sophisticated evasion techniques demonstrate APT28's evolving tactics in compromising webmail platforms for long-term intelligence gathering.

Pulse ID: 69ba83b93cb449af00474243
Pulse Link: https://otx.alienvault.com/pulse/69ba83b93cb449af00474243
Pulse Author: AlienVault
Created: 2026-03-18 10:51:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#2FA #APT28 #Browser #CredentialHarvesting #CyberSecurity #Email #Government #ICS #InfoSec #OTX #OpenThreatExchange #RAT #UK #Ukr #Ukraine #Ukrainian #Webmail #XSS #bot #AlienVault

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

LevelBlue Open Threat Exchange
The New OilMar 12

#APT28 hackers deploy customized variant of #Covenant #OpenSource tool

https://www.bleepingcomputer.com/news/security/apt28-hackers-deploy-customized-variant-of-covenant-open-source-tool/

#cybersecurity #Russia

APT28 hackers deploy customized variant of Covenant open-source tool

The Russian state-sponsored APT28 threat group is using a custom variant of the open-source Covenant post-exploitation framework for long-term espionage operations.

BleepingComputer
The Threat CodexMar 12
Operation Roundish: Uncovering an APT28 Roundcube Toolkit Used Against Ukrainian Government Targets
#APT28 #Roundcube
https://hunt.io/blog/operation-roundish-apt28-roundcube-exploitation
Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine

Hunt.io investigation uncovered Operation Roundish, an APT28 toolkit used to exploit Roundcube webmail and target Ukrainian government systems. Learn more.

securityaffairsMar 10
#APT28 conducts long-term espionage on Ukrainian forces using custom #malware
https://securityaffairs.com/189230/apt/apt28-conducts-long-term-espionage-on-ukrainian-forces-using-custom-malware.html
#securityaffairs #hacking #russia #ukraine
APT28 conducts long-term espionage on Ukrainian forces using custom malware

APT28 used BEARDSHELL and COVENANT malware to spy on Ukrainian military personnel, enabling long-term surveillance since April 2024.

Security Affairs
OTX BotMar 3

APT28 Leverages CVE-2026-21509 in Operation Neusploit

Zscaler’s ThreatLabz examines the technical details of Operation Neusploit, a Russia-linked advanced persistent threat group (APT28) that leveraged specially crafted RTF files to exploit CVE-2026-21509.

Pulse ID: 69a6d099bd131eb626296631
Pulse Link: https://otx.alienvault.com/pulse/69a6d099bd131eb626296631
Pulse Author: CyberHunter_NL
Created: 2026-03-03 12:14:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT28 #CyberSecurity #InfoSec #OTX #OpenThreatExchange #RAT #RTF #Russia #ThreatLabz #Zscaler #bot #CyberHunter_NL

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

LevelBlue Open Threat Exchange
securityaffairsMar 2
#Russia-linked #APT28 exploited #MSHTML zero-day CVE-2026-21513 before patch
https://securityaffairs.com/188782/security/russia-linked-apt28-exploited-mshtml-zero-day-cve-2026-21513-before-patch.html
#securityaffairs #hacking #Microsoft
Russia-linked APT28 exploited MSHTML zero-day CVE-2026-21513 before patch

Russia-linked APT28 reportedly exploited MSHTML zero-day CVE-2026-21513 before Microsoft patched it, a high-severity bypass flaw.

Security Affairs
The Threat CodexFeb 25
Inside the Fix: Analysis of In-the-Wild Exploit of CVE-2026-21513
#CVE_2026_21513 #APT28
https://www.akamai.com/blog/security-research/2026/feb/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis
OTX BotFeb 25

Organizations Targeted by APT28 Group via Webhook-Based Macro Malware

Pulse ID: 699f3c59b1d0c02a08fd005c
Pulse Link: https://otx.alienvault.com/pulse/699f3c59b1d0c02a08fd005c
Pulse Author: cryptocti
Created: 2026-02-25 18:15:53

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT28 #CyberSecurity #InfoSec #Mac #Malware #OTX #OpenThreatExchange #bot #cryptocti

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

LevelBlue Open Threat Exchange