WARNING: Russian State-Backed Laundry Bear Exploits Zimbra Zero-Day To Steal Emails & Authentication Data

A Russian state-supported hacking group has been exploiting a previously unknown vulnerability in Zimbra Collaboration Suite to silently steal emails, passwords, two-factor authentication codes and corporate address books from government and commercial organizations across Western countries.

The campaign, attributed to a threat group primarily known as Laundry Bear, has been active since at least July 2025 and represents a significant escalation in the group’s technical capabilities. Unlike conventional phishing attacks, the operation does not require victims to click a malicious link, download an attachment or enter credentials into a fraudulent website.

Instead, the malicious code can execute when a targeted user simply views a specially crafted email through a vulnerable version of Zimbra’s webmail interface.

The activity was detailed in a joint cybersecurity advisory issued by the US National Security Agency, FBI, Cybersecurity and Infrastructure Security Agency and more than 20 intelligence and cybersecurity organizations from allied countries.

The participating agencies include authorities from the Netherlands, United Kingdom, Australia, Canada, New Zealand, France, Italy, Spain, Sweden, Poland, Denmark, Finland, Estonia, the Czech Republic and Moldova.

The agencies assess that Laundry Bear is conducting espionage on behalf of the Russian government, with the primary objective of covertly obtaining email communications and other sensitive information from organizations connected to Western governments, defence, critical infrastructure and support for Ukraine.

The campaign has targeted organizations operating in the defence industrial base, federal and local government, education, energy, law enforcement, media, technology and non-governmental sectors.

At the centre of the campaign is CVE-2025-66376, a stored cross-site scripting vulnerability in the Classic UI component of Zimbra Collaboration Suite.

The vulnerability results from inadequate sanitization of Cascading Style Sheets @import directives inside HTML email messages. An attacker can construct an email containing embedded code that Zimbra fails to neutralize correctly before rendering it inside the recipient’s browser.

When the victim opens the message in an affected webmail session, attacker-controlled JavaScript runs in the security context of the authenticated user.

The US National Vulnerability Database identifies Zimbra Collaboration 10 releases before 10.0.18 and 10.1 releases before 10.1.13 as vulnerable. Zimbra addressed the defect on November 6, 2025, describing it as a stored XSS flaw that allowed attackers to abuse CSS directives in the Classic UI. Zimbra’s release documentation and the NVD vulnerability entry confirm the affected versions and remediation releases.

However, the campaign began around July 2025, approximately four months before the security update became available and six months before the vulnerability received a public CVE record in January 2026. Laundry Bear was therefore exploiting the weakness as a zero-day during the initial phase of the operation.

CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities catalogue on March 18, 2026, ordering US federal civilian agencies to apply vendor mitigations by April 1.

Although the attack is frequently described as “zero-click,” viewing the message is still necessary. Proofpoint has reportedly characterized the technique as a “half-click exploit” because no link or attachment interaction is required after the email is opened. The important defensive distinction is that traditional awareness advice—such as warning users not to click suspicious links—cannot stop the malicious code from running once a vulnerable webmail client renders the message. Reuters reported that the campaign requires no conventional social-engineering interaction beyond the email being viewed.

The custom exploitation and data-exfiltration capability used in the attacks has been named “Ulej,” transliterated from the Russian word “Улей,” meaning beehive.

The JavaScript responsible for the attack is concealed inside a Scalable Vector Graphics element in the email. Its initial payload is Base64-encoded, while the principal collection script is additionally protected with XOR encryption and another layer of Base64 encoding.

A series of CSS @import directives prepares the message to exploit CVE-2025-66376. Once the code executes, the outer payload decrypts and launches the main script.

Attackers can change the hardcoded XOR key or insert additional non-functional CSS instructions to produce new variants that may evade simple signature-based detection. This polymorphic capability does not fundamentally alter the exploit but makes it more difficult for email security products to identify every malicious message using a single static pattern.

The payload performs its work in 12 asynchronous stages. It initially sends a signal confirming that execution has begun before attempting to discover the victim’s email address and collect information about the Zimbra environment.

It then searches for two-factor authentication scratch codes, creates an application-specific password, examines registered devices and OAuth consumers, attempts to capture passwords stored by browser password managers, enables legacy mail access, downloads the organization’s Global Address List and retrieves up to 90 days of email.

The operation concludes by transmitting the stolen archives and sending a final signal to the attacker’s server.

This sequence turns what might initially appear to be a browser-side XSS vulnerability into a comprehensive mailbox-compromise capability. Because the JavaScript executes inside an authenticated Zimbra session, it can make requests that appear to originate from the legitimate user rather than from an unauthenticated external attacker.

Much of Ulej’s collection activity relies on Zimbra’s Simple Object Access Protocol, or SOAP, interface.

The malicious script first tries to obtain the current cross-site request forgery token from the browser’s local storage. If successful, it can submit authenticated SOAP commands using the victim’s active webmail session.

The commands are used to identify the compromised account, obtain information about the Zimbra installation and enumerate connected devices and OAuth applications. The script also searches the Global Address List, giving the attackers a directory of people and email addresses associated with the victim organization.

To reconstruct the address book, Ulej reportedly submits searches for every two-character combination drawn from letters, numbers and selected punctuation. These queries are divided into 20 batches containing more than 1,500 requests in total.

The resulting directory data could support several follow-on operations. It provides Laundry Bear with a map of the organization, identifies potentially valuable employees and supplies verified addresses for subsequent spear-phishing campaigns. It may also reveal relationships between government bodies, contractors, suppliers and external partners.

The malware attempts to export every non-junk email sent or received during the preceding 90 days.

It conducts separate requests for each day, asking Zimbra to return the results as compressed TGZ archives. The collection can include complete messages, contacts and attachments rather than only message metadata.

Ulej records completed collection dates in the browser’s local storage to avoid repeatedly downloading the same material if the malicious email is opened again on the same computer. The record may remain on the system indefinitely outside private browsing sessions.

The script nevertheless retrieves the current day’s correspondence each time it executes. This design could allow the attackers to acquire newly received messages if the victim returns to the malicious email.

The collection of three months of correspondence could expose government discussions, defence procurement information, operational planning, contracts, personal information and conversations with partner organizations. A single successfully compromised mailbox may also reveal documents and messages belonging to people who were never directly targeted.

Ulej goes beyond stealing existing email and attempts to create alternative ways for Laundry Bear to return after the browser-based exploit has finished.

During one stage, the script inserts hidden username and password fields outside the visible area of the webpage. It then waits to see whether the victim’s browser or password manager automatically fills those fields.

If a password appears, the script reads and exfiltrates it. The victim does not see a new login form because the fields are positioned off-screen.

The payload also requests the account’s two-factor authentication scratch codes through Zimbra’s SOAP interface. These recovery codes can sometimes be used when a normal second factor is unavailable, making them valuable to an attacker trying to regain access from a different device.

In another persistence mechanism, Ulej sends a request to create a new application-specific password labelled “ZimbraWeb.” Application passwords are intended to support clients that cannot complete a normal two-factor authentication process.

The script also attempts to enable IMAP access on the account. An attacker in possession of the newly generated application password could potentially connect to the mailbox through an IMAP client without repeating the victim’s usual multifactor authentication flow.

Administrators therefore cannot assume that deleting the malicious message or terminating the original browser session will remove the attacker. Incident responders must search for newly created application passwords, modified mail-protocol settings, exposed recovery codes, unexpected devices, OAuth authorizations and other changes to the account.

The information collected by Ulej is transmitted to an attacker-controlled framework known as Flowerbed.

Flowerbed is a Python-based project deployed using Docker and divided into four containers named Catcher, Certbot, Nginx and Gardener.

Catcher receives and temporarily stores data stolen from victims. Certbot automates the creation of Let’s Encrypt certificates, allowing the attackers to operate apparently valid HTTPS infrastructure. Nginx provides an encrypted reverse proxy, while Gardener performs health checks to confirm that the collection service remains operational.

The Nginx component checks the Server Name Indication value of incoming connections and only forwards traffic matching the naming pattern expected from Ulej. Other connections receive an HTTP 444 response, reducing unnecessary exposure of the collection system to researchers, automated scanners and unrelated internet traffic.

Laundry Bear primarily exfiltrates information through encrypted HTTPS requests, but Ulej also contains a fallback or supplementary DNS channel.

Before transmission, selected information is Base32-encoded and divided into labels that comply with DNS length restrictions. The script then attempts to load an invisible image from an attacker-controlled domain. Resolving the constructed hostname causes the encoded data to travel inside DNS queries.

This method is used for items including the victim’s address, Zimbra version, webmail client type, current URL, application password, two-factor authentication codes and any password captured through autocomplete.

HTTPS is used to transfer larger material, including message archives, address-book data, SOAP responses, attachments and diagnostic logs. Using valid TLS certificates encrypts the stolen information in transit and can make the outbound connections resemble ordinary web traffic.

The advisory says Laundry Bear generally operates each collection server for between seven and 60 days before moving to replacement infrastructure. The group uses virtual private servers from multiple providers, sometimes registering them with fabricated identities, and frequently connects through Mullvad VPN in an effort to conceal the operators’ locations.

Investigators found signs that artificial intelligence may have been used to produce portions of Flowerbed.

The advisory does not identify a particular AI platform or provide evidence that an advanced autonomous system was involved. Its assessment instead appears to be based on characteristics of the codebase.

Officials described Flowerbed as comparatively simple and suggested that reliance on AI-generated code, alongside the group’s earlier use of publicly available tools, may indicate limited traditional software-development expertise.

That assessment is significant because it demonstrates how an actor does not necessarily need an elite engineering team to build a functioning espionage pipeline. A group can combine a valuable vulnerability, browser-side JavaScript, open-source components, inexpensive hosting, automated certificates and AI-assisted code into an operational platform for large-scale intelligence collection.

The technically difficult part of the operation may have been identifying or acquiring the Zimbra zero-day and learning how to exploit it reliably. The receiving infrastructure did not need to be particularly advanced as long as it could collect, organize and forward the stolen data.

Laundry Bear is also tracked by Microsoft as Void Blizzard, by Palo Alto Networks as CL-STA-1114 and by Proofpoint as TA488, formerly UNK_PitStop. Threat-intelligence companies use different visibility and attribution standards, so these labels may not correspond perfectly across every reported operation.

Dutch intelligence services AIVD and MIVD publicly exposed Laundry Bear in May 2025, attributing several espionage operations to the Russian state-supported group.

The agencies linked it to a September 2024 intrusion that exposed work-related contact details belonging to Dutch police personnel. They said the group had also targeted NATO members, Western government institutions and companies involved in producing technology or military equipment that Russia has difficulty obtaining because of sanctions. The Associated Press reported that investigators believed the group was particularly interested in military procurement and Western weapons deliveries to Ukraine.

Microsoft independently assessed that Void Blizzard had been active since at least April 2024 and was conducting espionage against government, defence, transportation, healthcare, media and non-governmental organizations, particularly in Europe and North America.

Its earlier operations were not generally considered technically sophisticated. The group obtained stolen account credentials—potentially from criminal marketplaces and information-stealing malware ecosystems—and used password spraying, session-token replay and conventional credential phishing to enter cloud accounts.

In April 2025, Microsoft observed the group operating a fraudulent website that imitated the registration portal for a European defence and security conference. Victims were directed to sign in with their Microsoft accounts, after which a modified Evilginx adversary-in-the-middle toolkit intercepted credentials and authentication cookies.

Those session tokens allowed the attackers to bypass the practical protection offered by multifactor authentication and access compromised cloud accounts. Once inside, they downloaded large quantities of email and files through legitimate cloud APIs. Microsoft’s analysis of Void Blizzard describes its focus on NATO countries, Ukraine and organizations relevant to Russian strategic interests.

The Zimbra campaign retains the same intelligence objective but substantially improves the initial-access process. Instead of convincing users to enter credentials into a counterfeit portal, Laundry Bear can place executable content directly inside the mailbox and use the victim’s authenticated session to collect the data.

The advisory highlights extensive targeting of Ukrainian organizations before the same capability was deployed more widely against the United States and other NATO allies.

This follows a broader pattern in which Russian-aligned threat actors use Ukraine both as a priority intelligence target and as an operational environment in which to test techniques before applying them elsewhere.

In March 2026, Seqrite Labs documented a campaign called Operation GhostMail that exploited CVE-2025-66376 against a Ukrainian government entity. The malicious email was presented as an internship inquiry and contained no attachment, conventional phishing link or macro. Its attack chain was embedded in the HTML body and executed when rendered in vulnerable Zimbra webmail. Seqrite’s technical analysis attributed that observed activity with medium confidence to APT28.

The new government advisory instead assigns the Ulej campaign to Laundry Bear. This does not necessarily establish that every exploitation attempt involving CVE-2025-66376 came from the same operator. Once a vulnerability becomes known or shared across Russian cyber operations, multiple groups may use similar techniques, and separate investigations can reach different attribution judgments based on their respective evidence.

Since at least November 2025, Laundry Bear has sent some malicious messages from previously compromised email accounts.

Using legitimate infrastructure makes the emails more likely to bypass reputation-based filtering and appear trustworthy to recipients. It also complicates attribution because defenders initially see messages originating from a real partner, colleague or previously victimized organization rather than an obviously malicious domain.

This creates a self-sustaining cycle. One compromised mailbox can provide the attackers with the organization’s address book, trusted correspondence and external contacts. Those resources can then be used to select and approach additional victims.

The operation therefore carries supply-chain-like consequences even when no software supplier is breached. Trust accumulated through normal business email relationships is repurposed to spread the next stage of the espionage campaign.

Organizations operating Zimbra Collaboration Suite should update immediately to a supported, fixed release. For the two affected ZCS 10 branches, the first corrected versions are 10.0.18 and 10.1.13. Administrators should use the latest security release available for their supported branch rather than treating those minimum versions as a long-term target.

If an immediate upgrade is impossible, the joint advisory recommends preventing users from accessing email through the vulnerable webmail interface and directing them to an alternative client until the server can be patched.

However, installing the update only prevents future exploitation. It does not remove application passwords, reverse account changes or invalidate credentials already stolen during an earlier compromise.

Organizations that identify indicators associated with Ulej or Flowerbed should treat the incident as a full email-account compromise. Response actions should include isolating affected systems, preserving relevant evidence and engaging appropriate incident-response and law-enforcement contacts.

Administrators should review Zimbra versions and patch histories, webmail and SOAP activity, DNS logs, proxy records and outbound HTTPS connections. They should also investigate unexpected IMAP enablement, newly generated application passwords, exposed 2FA scratch codes, suspicious OAuth consumers and unfamiliar registered devices.

Affected credentials and session tokens should be revoked or rotated after the environment has been investigated and secured. Rotating credentials too early, while the attacker still has persistence, can allow the replacement secrets to be captured as well.

Because the payload can attempt to steal saved credentials through hidden autocomplete fields, responders may also need to assess whether passwords stored in browsers or password managers were exposed during execution.

The international agencies warned that disclosure and widespread patching could force Laundry Bear to abandon this particular exploit chain. They nevertheless assess that the group is very likely to continue targeting Zimbra and other email platforms.

The success of the operation demonstrates why internet-facing email systems remain high-value espionage targets. They concentrate sensitive communications, credentials, attachments and organizational relationships in a single service—and, in this case, rendering one email in vulnerable software was enough to expose them all.