Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
financialThreat Actor
Active Threat
TA488
40
IOCs Tracked
7
Intel Reports
Associated IOCs40 total
Domain19
asecdns.com2026-10-09High
acocdn.com2026-10-09High
synacorzimbra.nl
2026-10-09Highanalyticemailmeter.com
2026-10-09Highzxzaq.com2026-10-09High
hgmydr.wiki2026-10-09High
xwe.us2026-10-09High
share-ya.space2026-10-09High
upgybj.store2026-10-09High
xsza.net2026-10-09High
zimbrastat.com2026-10-09High
mailnalysis.com2026-10-09High
zimbra-metadata.com2026-10-09High
zimbrasoft.com.ua2026-10-09High
emailanalytics.com.ua2026-10-09High
istc-cloud.com2026-10-09High
zmailanalytics.com2026-10-09High
tdndns.com2026-10-09Medium
dnsrecursive.eu2026-10-09Medium
SHA25612
6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c42026-10-09High
fb8ec4dbed14c0a91361abd82ebe9fb083615c3dbb15348f57317af7cc41dd34
2026-10-09Higha0c80cab70d6672b01710a70f93311fc1c1db2fbbf9cd6daa543c34b87e3444a2026-10-09Medium
60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb8742026-10-09Medium
8b5a4dc237a4c89042176bc89864a4c357dcdd14fa544fe6496ccb6c31cd5b7f2026-10-09Medium
6b2c02bf82087a3ca5fb7ef8046554ff29ce85d52202bdcfae2b2653aede139a2026-10-09Medium
b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d2026-10-09Medium
98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf2026-10-09Medium
e27d1bf82249002a66395c89dbda6ec5d8df012a84b79d36fffbbf7808d288782026-10-09Medium
1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead7602026-10-09Medium
625e4c166c7a1d5a1becf56b27d4f76a2f95935cbd8d556c30a493263d10dbf82026-10-09Medium
3a449148a0e3cac604fb93210dd7d91ccf48e06ed9aae064bc53a419a84ce9ba2026-10-09Medium
CVE9
CVE-2026-428972026-10-21High
CVE-2025-663762026-10-09High
CVE-2025-491132026-10-20Medium
CVE-2025-279152026-10-09Medium
CVE-2024-420092026-10-09Medium
CVE-2023-437702026-10-09Medium
CVE-2026-84962026-10-09Medium
CVE-2025-39292026-10-09Medium
CVE-2024-429002026-10-09Medium
Related Reports7 total
Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit
Proofpoint Threat InsightJul 29, 2026
TA488 Targets Zimbra Mailservers with Half-Click Exploits
Proofpoint Threat InsightJul 23, 2026
ta458 roundpress exploits
Proofpoint Threat InsightJul 23, 2026
NSFOCUS Monthly APT Insights – July 2026
NSFOCUS Security LabsSep 29, 2026
THREAT ADVISORY Russian APT “Laundry Bear” Exploiting OWA XSS for Persistent Mailbox Access August 5, 2026
Blackswan CybersecurityAug 5, 2026
Weekly Cybersecurity Newsletter — Top 50 Cybersecurity Stories of the Week (July 27–August 1, 2026)
Cyber PressAug 3, 2026
Russian LAUNDRY BEAR Hackers Exploit Zimbra Zero-Day to Steal 90 Days of Emails
Cyber PressJul 24, 2026
Threat Profile
Motivationfinancial
Last seenOct 2026
IOCs tracked40