TA488 Targets Zimbra Mailservers with Half-Click Exploits

Proofpoint is releasing this report in coordination with NSA and FBI’s JSAC reporting about TA488/Void Blizzard, which can be found here. This is part 1 of a 2-part blog series Proofpoint is publishing about Russian espionage actors using half-click exploits to target government webmail servers. Read part 2 about TA458 here. Threat Research would like to thank the Proofpoint Cloudmark Authority team. Key Findings Proofpoint uncovered that Russia-aligned threat actor…

Diamond Model