UK and partners expose Russian state-backed ‘zero-click’ phishing attack
Share
UK government and intelligence agencies have issued an urgent warning about a sophisticated cyber-espionage campaign orchestrated by Russian state-supported threat actors.
The malicious campaign is driven by an advanced persistent threat group known as LAUNDRY BEAR, which is actively targeting organisations across Western government and commercial sectors to harvest sensitive email communications covertly.
The primary target of the operation is the Zimbra Collaboration Suite (ZCS), a widely used web-based email and enterprise productivity platform.
Unlike traditional phishing attacks that require a user to click a suspicious link or download an unsafe attachment, this operation utilises a stealthy zero-click exploit. The hackers leverage a specific software vulnerability, tracked as CVE-2025-66376, alongside a custom data exfiltration tool called Ulej.
Under this method, a target only needs to view an incoming malicious email within a vulnerable webmail interface for the system to become compromised automatically.
Since mid-2025, investigators have identified more than ten successful or attempted breaches across critical industries including defence, local and federal government agencies, law enforcement, technology firms, educational institutions, media outlets, and non-governmental organisations.
Once inside the network, the threat group attempts to steal sensitive user credentials, including account passwords and multi-factor authentication tokens.
In response to the escalating threat, cybersecurity authorities are strongly urging organisations that use ZCS to apply the latest software patches immediately and continuously monitor webmail logs for suspicious activity. Officials emphasise that international cooperation remains vital for uncovering state-backed cyber threats and protecting essential networks from digital espionage.
Says Security Minister Dan Jarvis MBE:
“Today’s action shows we’re working hand-in-hand with our allies to expose Russian state-supported hackers targeting Western organisations. It’s particularly concerning that these thugs tested their methods on victims in Ukraine, before targeting members of NATO.
“Organisations across the UK should sign up to NCSC’s Early Warning service to ensure they can quickly secure their systems against similar activity.”
Commenting on the threat, Dray Agha, senior manager of security operations at Huntress, said:
“These exploits are a worst-case scenario for defenders because it is a zero-click attack, meaning simply viewing the email in a vulnerable client triggers the compromise. This completely bypasses traditional employee security training and gives state-backed hackers a silent, invisible backdoor into sensitive communications without the victim ever making a mistake.
“Fortunately, this is why defence-in-depth is advised, as where the human security layer is porous, the technical defensive layer can step in. Organisations shouldn’t just rely on their staff acting as a “human firewall.” Rapid software patching, coupled with layered technical defences, is the only reliable safety net against modern state-sponsored threats.”
Related Posts
Discover more from Tech Digest
Subscribe to get the latest posts sent to your email.
