Max-severity Exchange server flaw under active exploitation by Kremlin hackers

Proofpoint RSS entries report active exploitation of a maximum-severity Microsoft Exchange Server vulnerability by Kremlin-linked actors, Russian exploitation of a Zimbra zero-day to steal email and two-factor authentication codes, suspected Chinese targeting of Roundcube mail servers, and techniques for validating stolen Microsoft Entra credentials and covertly collecting Entra user data. The feed also covers ransomware trends and recurring ransom payments, indicating significant threats to email, identity, and collaboration infrastructure.