Bright Nexus

Published on July 24, 2026

Russian Espionage Group Exploited Zimbra Zero-Day to Compromise Western Government and Commercial Organizations

Severity
Medium

Detail

Russian state-backed threat group Laundry Bear has been linked to an espionage campaign targeting organizations by exploiting CVE-2025-66376, a cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite (ZCS) webmail platform. According to a joint advisory issued by the NSA, FBI, CISA, and international cybersecurity partners, the campaign has been active since July 2025 and primarily targets the covert collection of email data.

The campaign has affected organizations across multiple sectors, including the defense industrial base, government, education, energy, law enforcement, media, non-government organizations, and technology. Researchers noted that the threat actor initially targeted Ukrainian organizations before expanding its operations to U.S. and NATO member states.

How?

Laundry Bear exploited CVE-2025-66376, a stored XSS vulnerability in Zimbra’s webmail interface that allows JavaScript embedded in a specially crafted HTML email to execute when the email is viewed. The attack requires only that a user open the malicious email in a vulnerable version of Zimbra and does not require the victim to click a link or open an attachment.

The attackers used a custom capability named Ulej to exploit the vulnerability and collect the victim’s last 90 days of email, email addresses and passwords, the organization’s email directory (including the Global Address List), two-factor authentication tokens, and newly created application passcodes. The stolen information was exfiltrated to a backend infrastructure known as Flowerbed, which consists of Docker containers hosted on rented cloud servers. The group also used Mullvad VPN and regularly rotated its infrastructure to hinder tracking.

Figure 1:  The attack chain

Impact

The campaign enabled the attackers to obtain:

  • The previous 90 days of victim emails.
  • The organization’s complete Global Address List (GAL).
  • Browser-stored passwords.
  • Two-factor authentication recovery codes.
  • Application-specific passwords that could survive password resets.
  • Continued mailbox access through IMAP, POP3, or SMTP without requiring two-factor authentication.

Proofpoint reported that compromised accounts were subsequently used to distribute additional exploit emails from legitimate mail servers. Unit 42 identified at least nine command-and-control IP addresses and nine domains associated with the campaign.

Recommendations

The organization are recommended to: –

  • Upgrade Zimbra 10.1 deployments to version 10.1.13 or later.
  • Migrate Zimbra 10.0 deployments to a supported 10.1 release, as version 10.0 reached end of life on 31 December 2025.
  • Reset passwords for potentially compromised accounts.
  • Invalidate active user sessions.
  • Regenerate two-factor authentication scratch codes.
  • Review /opt/zimbra/log/audit.log for CreateAppSpecificPassword requests and remove any credentials named “ZimbraWeb”.
  • Identify accounts with zimbraPrefImapEnabled set to TRUE where IMAP is not required.
  • Monitor for SOAP requests to GetScratchCodesRequest.
  • Filter and monitor DNS traffic for the published command-and-control domains and suspicious DNS queries used for data exfiltration.
  • Inspect suspicious HTML emails for the fragmented @import pattern associated with the exploit.

Conclusion

The exploitation of CVE-2025-66376 demonstrates how a stored XSS vulnerability in Zimbra’s Classic Web Client was used to conduct long-term espionage against government and commercial organizations. Although patching prevents future exploitation, the advisory emphasizes that organizations should also investigate potentially compromised accounts, as stolen credentials, application-specific passwords, and authentication data may continue to provide attackers with unauthorized access after systems have been updated.

Source

https://gbhackers.com/russian-laundry-bear-hackers-exploit-zimbra/
https://thehackernews.com/2026/07/russian-espionage-group-exploited.html
https://www.helpnetsecurity.com/2026/07/24/laundry-bear-zimbra-vulnerability-cve-2025-66376/
https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a