Russia's Winter Vivern steals government emails through Zimbra flaw

A Russia-based threat group known as Winter Vivern or TA473 has been targeting a flaw in the Zimbra webmail client to exfiltrate emails from officials in European countries. That's according to a report from security vendor Proofpoint, which has been tracking this activity since February. It does not identify the countries concerned. The attackers exploit a vulnerability tracked as CVE-2022-27926 on unpatched internet-facing Zimbra Collaboration servers, which it discovers using a vulne...