ProofpointPublished
TA488 Targets Zimbra Mailservers with Half-Click Exploits
Excerpt
By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team
July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team
Proofpoint is releasing this report in coordination with NSA and FBI’s JSAC reporting about TA488/Void Blizzard, which can be found here. This is part 1 of a 2-part blog series Proofpoint is publishing about Russian espionage actors using half-click exploits to target government webmail servers. Read part 2 about TA45…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Proofpoint on proofpoint.com.
Mentioned in the excerpt
More from Proofpoint7
- Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy CirclesProofpoint · Published 30 Sep
- Carry-On Compromise: TA4922 Packs PackClientProofpoint · Published 25 Aug
- Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click ExploitProofpoint · Published 28 Jul
- ta458 roundpress exploitsProofpoint · Published 15 Jul
On the same topics
- ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoftMandiant (Google) · Published 25 Sep
- Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukrainebluecyber.hashnode.dev · Published 22 Jul
- DragonBreath: Dragon in the Kernelransom-isac.com · Published 22 Apr
- Iranian APT group ‘MuddyWater’ Adds Exploits to Their ArsenalClearSky · Published 6 Jun 2019
