Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

Proofpoint reported that a Russian state-linked espionage group exploited a Zimbra zero-day in the wild to steal email contents and intercept two-factor authentication (2FA) codes, enabling account takeover and persistent access without social-engineering. US and allied agencies corroborated the activity; impacted organizations should urgently apply vendor fixes/mitigations, rotate credentials and 2FA tokens, review mailserver logs for exfiltration, and enforce stronger session and access controls.