A Russian state-sponsored hacking group, identified by Microsoft as Void Blizzard and by U.S. agencies as Laundry Bear, is exploiting a security vulnerability in unpatched versions of the Zimbra Collaboration Suite to steal sensitive information without requiring users to click on links or attachments.
The Cybersecurity and Infrastructure Security Agency (CISA), along with the National Security Agency, FBI, and international cyber authorities, issued a warning regarding this threat. The attack targets organizations using vulnerable Zimbra installations. Once a malicious message is opened or previewed, hidden code can extract passwords, two-factor authentication tokens, and up to 90 days of email content.
The vulnerability, tracked as CVE-2025-66376, is a cross-site scripting flaw affecting the Classic user interface of certain Zimbra versions. Attackers embed malicious JavaScript within specially crafted HTML emails. This code executes automatically when the message is displayed in a vulnerable Zimbra webmail client. This technique has been described as a zero-click exploit by CISA and a "half-click" attack by Proofpoint, as the email itself, or its preview, triggers the compromise.
Laundry Bear reportedly utilized this flaw as a zero-day before Zimbra released a patch in November 2025. Despite the availability of the fix, the group continues to target organizations that have not yet installed the update, highlighting the persistent danger of delayed patching. The attack has affected over a dozen Western organizations since July 2025, with targets including entities connected to the defense industrial base, government, education, energy, law enforcement, media, nonprofit groups, and technology companies.
The stolen data can include internal communications, contract discussions, upcoming meeting details, password reset notices, and organizational operational information. The hackers also aim to steal user credentials and the organization's Global Address List, enabling them to impersonate employees and identify more valuable targets. The exploit also targets two-factor authentication tokens and session cookies, allowing attackers to bypass normal login procedures.
Beyond data exfiltration, Laundry Bear attempts to maintain persistent access by creating new Zimbra application passcodes. These legacy passcodes can allow access even after the main account password is changed. CISA advises administrators to scrutinize Zimbra accounts for suspicious application passcodes, especially those labeled "ZimbraWeb."
The stolen data is exfiltrated to servers controlled by the group using a framework called Flowerbed. This system can conceal data within normal Domain Name System (DNS) requests or transmit larger archives via encrypted HTTPS connections. Identifying such activity often requires detailed inspection of network logs, authentication records, and mailbox activity.
Laundry Bear also employs adversary-in-the-middle phishing kits, creating fake login pages that mimic legitimate email portals. These kits capture credentials and session cookies, compromising accounts protected by conventional multifactor authentication.
Dutch intelligence agencies previously identified Laundry Bear in May 2025, linking the group to a 2024 breach of the Dutch National Police. Since at least 2024, the group has focused on organizations relevant to Russian strategic interests, including NATO member states and entities supporting Ukraine. Microsoft has documented compromises of defense organizations and entities in transportation and aviation, as well as a separate campaign targeting Ukrainian military members with charity-themed phishing emails.
To mitigate this threat, organizations are urged to immediately update their Zimbra Collaboration Suite to a supported version and install all security patches. Administrators should also review network and authentication logs for signs of compromise, revoke any unauthorized application passcodes, and examine mailbox activity for suspicious entries. Employees should report any unusual activity to their IT department and change passwords only after the system has been secured and unauthorized access removed. CISA also recommends the use of phishing-resistant multifactor authentication where possible.
While antivirus software can offer some protection, it may not prevent this specific email exploit, emphasizing the critical need for timely software patching and thorough investigation of affected accounts.