Protecting Against Zero-Click Attacks

Russian state-sponsored actors exploited a zero-day XSS vulnerability in Zimbra Collaboration Suite, requiring no user interaction to compromise target systems — simply receiving and opening an email was sufficient to trigger the attack. This allowed attackers to establish persistence, exfiltrate sensitive emails, and conduct espionage against critical industries across Western nations. The incident underscores the extreme risk posed by unpatched internet-facing communication platforms, especially those processing sensitive organisational data. Zero-click vulnerabilities are particularly dangerous because traditional security awareness training offers no meaningful defence — technical controls and rapid patching are the only effective mitigations. The coordinated advisory from NCSC and 15 allied nations signals the severity and breadth of the campaign's impact.