Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by the Dutch AIVD and MIVD (2025) and by US, UK, Canadian and other allied agencies (July 2026) to Russian state-supported actors, LAUNDRY BEAR steals email from government, defense and technology bodies.
In short
Attributed by the Dutch AIVD and MIVD (2025) and by US, UK, Canadian and other allied agencies (July 2026) to Russian state-supported actors, LAUNDRY BEAR steals email from government, defense and technology bodies. The July 2026 joint advisory describes a view-based attack on Zimbra webmail that took 90 days of mail without a click.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| LAUNDRY BEAR | Name given by the Dutch AIVD and MIVD in their advisory of 27 May 2025; used as the main name in CISA advisory AA26-204A[1, 2] |
| Void Blizzard | Listed in CISA advisory AA26-204A under "Cybersecurity industry tracking"; also printed in a footnote of the AIVD and MIVD advisory[1, 2] |
| CL-STA-1114 | Listed in CISA advisory AA26-204A under "Cybersecurity industry tracking"[1] |
| TA488 | Listed in CISA advisory AA26-204A under "Cybersecurity industry tracking", "formerly UNK_PitStop"[1] |
| UNK_PitStop | Earlier name of TA488 as printed in CISA advisory AA26-204A[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
AIVD and MIVD (Netherlands) 27 May 2025
Named the group LAUNDRY BEAR and called it a previously unknown, highly probably Russian state-supported actor. Its non-destructive attacks highly probably indicate an espionage motive.[2]
AIVD and MIVD (Netherlands) 27 May 2025
Said LAUNDRY BEAR and APT28 are two distinct threat actors, despite similar target choice and password spraying.[2]
NCSC (Netherlands) 27 May 2025
Told Dutch organizations about the AIVD and MIVD publication and said the actor took part in the September 2024 attack on the police.[5]
Estonian Information System Authority (RIA) Yearbook updated 11 February 2026
Said the Dutch services assess Laundry Bear as very likely a state-sponsored Russian group, and listed its affiliation as "Unknown".[8]
CISA, NSA, FBI and partner agencies 23 July 2026
Said Russian state-supported actors, primarily tracked as LAUNDRY BEAR, have targeted Western government and commercial bodies through Zimbra since at least July 2025.[1]
CISA, NSA, FBI and partner agencies 23 July 2026
Said the covert, persistent activity and no known financial extortion almost certainly point to espionage with Russian government backing.[1]
NCSC-UK 23 July 2026
Said LAUNDRY BEAR is an advanced persistent threat group whose ongoing campaign is almost certainly carried out with Russian state support.[3]
Canadian Centre for Cyber Security 23 July 2026
Said Russia-sponsored actors tied to the advanced persistent threat group known as Laundry Bear are exploiting Zimbra webmail.[4]
CERT-EU 3 August 2026
Described Laundry Bear as a Russia-linked threat actor that ran a zero-click phishing campaign against Zimbra webmail users.[7]
No source names a specific Russian agency. The AIVD and MIVD (27 May 2025) call the actor "highly probably" Russian state-supported, while CISA and partners (23 July 2026) say the activity "almost certainly" involves espionage with Russian government backing. The Estonian RIA lists its affiliation as "Unknown". CISA also warns that industry names may not match the US government's view one for one.
Each entry is attributed to the group by the sources cited.
CISA says the May 2025 advisories assessed that the group was active in cyber operations as early as April 2024.[1]
The AIVD and MIVD say the actor gained access to a police employee account and took the work contact details of all police staff. The cookie was likely bought on a criminal marketplace.[2]
CISA says a site resembling a European Defense & Security Summit registration portal collected Microsoft sign-ins, using a modified Evilginx toolkit.[1]
CISA says the group moved to a more technical method using a custom capability, Ulej, against Zimbra Collaboration Suite webmail. The flaw was a zero-day when first used.[1]
CISA's indicator table lists the first collection domain as first seen on this date.[1]
CISA says a patch came in November 2025. From at least November 2025, phishing mail was sent from victim accounts.[1]
NVD records CVE-2025-66376 as published on this date.[10]
CISA's Known Exploited Vulnerabilities catalog added CVE-2025-66376.[11]
CERT-EU's July 2026 Cyber Brief covers the advisory.[7]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 27 May 2025 | AIVD and MIVD (Netherlands) | Public advisoryNamed LAUNDRY BEAR, described its methods and listed resilience measures.[2] |
| 27 May 2025 | NCSC (Netherlands) | Notice to organizationsPassed on the publication and set out key measures such as phishing-resistant multi-factor authentication.[5] |
| 18 March 2026 | CISA | Known Exploited Vulnerabilities catalogAdded CVE-2025-66376 with a due date of 1 April 2026.[11] |
| 23 July 2026 | CISA, NSA, FBI, AIVD, MIVD and partners | Joint advisory AA26-204AWarned of the Zimbra campaign, gave mitigations, remediation steps and indicators.[1] |
| 23 July 2026 | NCSC-UK | News alertCo-sealed the advisory and urged UK organizations to sign up to its Early Warning service.[3] |
| 23 July 2026 | Canadian Centre for Cyber Security | News noticeJoined the advisory and urged patching and monitoring of Zimbra systems.[4] |
| 3 August 2026 | CERT-EU | Cyber BriefSummarized the advisory in its July 2026 brief.[7] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing T1566
Sends an email with a script that runs when the user views it in Zimbra webmail.[1]
Valid Accounts T1078
Buys or reuses stolen credentials and cookies, including from criminal marketplaces.[1, 2]
Trusted Relationship T1199
Since at least November 2025 sends phishing from compromised victim accounts.[1]
Brute Force: Password Spraying T1110.003
Tries a few common passwords across many accounts, using address lists stolen earlier.[2]
Steal Web Session Cookie T1539
Uses cookies likely taken by infostealer malware and bought online (pass-the-cookie).[2]
Adversary-in-the-Middle T1557
In earlier campaigns a modified Evilginx toolkit intercepted passwords and session tokens.[1, 9]
Modify Authentication Process: Multi-Factor Authentication T1556.006
Creates an Application Passcode and tries to read two-factor scratch codes.[1]
Ulej Custom script (JavaScript)
CISA describes a new data theft and collection capability, Russian for beehive, used against Zimbra webmail users through CVE-2025-66376.[1, 3]
Flowerbed Collection framework
A Python project in Docker, run on rented servers, that receives and gathers the data Ulej steals.[1]
Catcher Flowerbed container
Acts as a DNS and web server that receives the stolen data.[1]
Certbot Flowerbed container
Based on an official image, makes free Let's Encrypt certificates automatically.[1]
Nginx Flowerbed container
An HTTPS front end for Catcher that only passes traffic whose server name contains "*.i.*".[1]
Gardener Flowerbed container
A simple script that checks Catcher is receiving and processing data.[1]
Evilginx (modified) Open source adversary-in-the-middle toolkit
CISA says the group used a modified version to intercept sign-ins in 2025. MITRE lists evilginx2 as a reverse proxy that captures credentials and cookies.[1, 9]
Built-in system tools Living off the land
The AIVD and MIVD say the group does not seem to use its own malware but uses tools already on victims' systems (2025).[2]
Also linked in our threat library:
Follow new government advisories, the names, tools and techniques they attribute to LAUNDRY BEAR, and whether your sector and region match the targets they list.
See whether Zimbra webmail or other mail sign-in pages are reachable from the internet, the exposure the advisory describes.
Watch for staff credentials and session cookies offered on criminal marketplaces, which the AIVD and MIVD say the group buys.
Find look-alike domains and fake sign-in pages, such as the fake event portal CISA describes.
The Dutch AIVD and MIVD named it on 27 May 2025 and attribute it, as highly probably Russian state-supported. CISA and partners (23 July 2026) say it is almost certainly espionage with Russian government backing. No source names a specific agency.
No source says so. The AIVD and MIVD saw similarities in targets and password spraying but state that the two are distinct actors.
CISA says a flaw (CVE-2025-66376) let a script run when a user merely viewed a malicious email. The script tried to take 90 days of mail, the address book and 2FA details, and to add an Application Passcode.
CISA described the Zimbra campaign as ongoing on 23 July 2026 and expects the group to keep targeting Zimbra and other email systems even if this campaign stops.
CISA says to check Zimbra logs for address-book search bursts, an Application Passcode named "ZimbraWeb" and scratch-code requests, and to search browser storage for items named zd_comp followed by a date.
Update Zimbra to 10.1.13 or 10.0.18, revoke Application Passcodes if you find signs of compromise, and use phishing-resistant multi-factor sign-in.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.