Glossary term
Zero-day vulnerability
A zero-day vulnerability is a weakness in hardware, firmware or software that was previously unknown.
Read more
Significant cyber incident
Zimbra webmail exploitation by Russian state actors
On 23 July 2026 the US CISA, NSA, FBI and partner agencies warned that Russian state-supported actors, tracked mainly as LAUNDRY BEAR, were breaking into Zimbra Collaboration Suite webmail.
In short
On 23 July 2026 the US CISA, NSA, FBI and partner agencies warned that Russian state-supported actors, tracked mainly as LAUNDRY BEAR, were breaking into Zimbra Collaboration Suite webmail. The flaw, CVE-2025-66376, runs hidden code when a user simply views a malicious email. The advisory says the group has used it since at least July 2025 to try to copy 90 days of email, the address book and login data.
What happened
On 23 July 2026 CISA, the NSA, the FBI and partner agencies from many countries published advisory AA26-204A. It says a Russian state-supported group, tracked mainly as LAUNDRY BEAR, has targeted Western government and commercial organizations that use Zimbra Collaboration Suite (ZCS) since at least July 2025.
The group sent emails that carried hidden JavaScript. In a vulnerable ZCS webmail, the code ran as soon as the user viewed the email. It then tried to copy the last 90 days of email, the organization address book, two-factor codes and saved passwords to servers the group controlled.
The flaw is CVE-2025-66376. The advisory says it was a zero-day when first used, and that it was patched in November 2025. No victim organization is named.
Timeline
-
April 2024
The May 2025 Dutch and Microsoft advisories assess the group was active as early as this month (as reported in AA26-204A)
-
23 September 2024
Dutch police are hit by a cyber attack later linked by the Dutch services to LAUNDRY BEAR
-
27 May 2025
The Dutch AIVD and MIVD publicly name the actor LAUNDRY BEAR
-
July 2025
AA26-204A says the ZCS campaign began; the first listed Flowerbed domain was first seen 8 July 2025
-
6 November 2025
Zimbra releases ZCS 10.0.18 and 10.1.13, which patch CVE-2025-66376
-
November 2025
At least from this month, phishing emails are sent from compromised accounts at victim organizations (AA26-204A)
-
31 December 2025
Zimbra 10.0 reaches end of life, according to Zimbra's release page
-
5 January 2026
NVD publishes CVE-2025-66376
-
18 March 2026
CISA adds CVE-2025-66376 to its Known Exploited Vulnerabilities catalog
-
1 April 2026
KEV due date for the listed action
-
23 July 2026
CISA and partners publish advisory AA26-204A
How the attack worked
Finding targets
The advisory says the group likely picks victims by hand. It likely finds public-facing Zimbra servers by port scanning and fingerprinting data bought from commercial vendors, then collects staff email addresses from bought data, open sources or earlier stolen data. It uses rented servers under fabricated identities, often for only 7 to 60 days.
The malicious email
The attacker sends a Phishing (T1566) email that carries JavaScript. The flaw, CVE-2025-66376, comes from improper handling of CSS @import directives in email. The code runs when the user views the email in ZCS webmail, which the advisory maps to Exploitation for Client Execution (T1203). The payload is Base64 encoded inside an SVG element and holds an XOR-encrypted inner script, so small changes can slip past basic signatures. Since at least November 2025 the emails were sent from compromised accounts at earlier victims, mapped to Trusted Relationship (T1199).
What the script does
The script runs 12 stages, mapped to Automated Collection (T1119). It uses the logged-in session to send requests to Zimbra. It reads the victim address, tries to turn on IMAP, creates a new Application Passcode, copies two-factor scratch codes, tries to read a password the password manager fills in on a hidden form, and searches the whole address book by brute force. It then pulls non-junk email for each of the last 90 days (Email Collection, T1114).
Sending data out
Data goes to the group’s Flowerbed collection framework by DNS queries and by HTTPS (Exfiltration Over Alternative Protocol, T1048). Let’s Encrypt certificates let the group set up new infrastructure fast.
ATT&CK techniques
Who says who was behind it
Who attributed it, and how firm it is
Attributed by CISA, NSA, FBI and partner agencies in advisory AA26-204A, 23 July 2026: "Russian state-supported cyber actors", tracked primarily as LAUNDRY BEAR. The advisory says the targeting is "almost certainly" for information gathering for the Russian Federation.
The name LAUNDRY BEAR was coined by the Dutch AIVD and MIVD, who described the actor on 27 May 2025 as highly probable Russian state-supported.
The advisory lists other names used in the security industry and notes that these may not match the US government's view for all activity.
Malware and vulnerabilities used
- Malware Evilginx Evilginx is a free, open source toolkit that sits between a victim and a real website and copies what passes through, including passwords and login session cookies. Legitimate tool abused · IaaS, Identity Provider, Office Suite, SaaS
- Malware Ulej Ulej (Russian for beehive) is a custom data theft capability that the joint advisory AA26-204A describes as used by the Russian state-supported group LAUNDRY BEAR against Zimbra Collaboration Suite webmail. Infostealer · Since 2025 · Zimbra Collaboration Suite webmail, Docker
Impact
The advisory says LAUNDRY BEAR compromised users in organizations linked to the defense industrial base, federal and local government, education, energy, law enforcement, media, non-governmental organizations and technology. No victim is named and no counts of victims or emails are given.
Data the exploit attempted to take: the last 90 days of email, the email address, passwords, the Global Address List, two-factor tokens and a newly created Application Passcode.
The advisory says that by the time an organization finds the compromise, many sensitive and proprietary emails have often already been exfiltrated. It sees no known financial extortion and describes the activity as espionage.
Government and regulator response
- 6 November 2025: Zimbra released ZCS 10.0.18 and 10.1.13 with a fix for the stored XSS in the Classic UI.
- 5 January 2026: NVD published CVE-2025-66376.
- 18 March 2026: CISA added the flaw to its Known Exploited Vulnerabilities catalog with a due date of 1 April 2026.
- 23 July 2026: CISA, NSA, FBI, the Dutch AIVD and MIVD and other partner agencies published AA26-204A with indicators of compromise, mitigations and remediation steps.
- The advisory says to patch to a fixed ZCS version. If that is not possible, avoid the Classic webmail client. After a compromise, revoke all Application Passcodes and 2FA scratch keys and change passwords.
Lessons
-
One viewed email can be enough
The advisory says the exploit only needs a user to view a malicious email in a vulnerable webmail. Warning users not to click links would not help against this kind of attack.
-
Webmail is a high-value target
The group focused on covert email collection and tried to take 90 days of mail and the whole address book. Mail servers deserve the same patch urgency as other internet-facing systems.
-
Patch months matter
Zimbra released the fix on 6 November 2025, but the advisory says exploitation continued and CVE publication came on 5 January 2026. Watching vendor release notes, not only CVE feeds, can save time.
-
Backup access routes need watching
The script tried to turn on IMAP and create an Application Passcode, which can keep access when the browser session ends. These settings should be monitored.
-
Password managers can leak
The script tried to read a password filled in by the password manager on a hidden form. The advisory suggests passkeys through a third-party service in front of ZCS.
-
Old versions get left behind
Zimbra's page says 10.0 reached end of life on 31 December 2025 and that 10.1 is the supported version.
What to check in your own organization
-
Find your ZCS version
List every Zimbra server and confirm it runs 10.0.18 or later on 10.0, or 10.1.13 or later on 10.1. Zimbra says 10.1 is the supported line.
-
If you cannot patch
The advisory says to have staff use another mail client and avoid the Classic webmail client until you update.
-
Review Application Passcodes and 2FA codes
Look for passcodes named "ZimbraWeb" and unexpected new ones. After a confirmed compromise, revoke all Application Passcodes and 2FA scratch keys.
-
Check IMAP settings
The script tries to switch IMAP on for the victim account. Look for accounts where IMAP became enabled without a reason.
-
Watch outbound traffic
The advisory lists large outbound data to unfamiliar VPS providers, many DNS queries to odd subdomains, newly created domains, and webmail logins from Mullvad VPN.
-
Compare against the IOC list
Check logs against the domains and certificates in AA26-204A. The advisory warns they may be outdated, so check for current activity too.
-
Early warning
Threat intelligence monitoring could watch new vulnerability alerts for software you run, entries added to CISA's exploited vulnerabilities catalog, reports naming groups like LAUNDRY BEAR, and exposed staff credentials. Any of these might have prompted earlier patching and password resets. This is not a promise of detection.
Where it happened
Questions
What is CVE-2025-66376?
NVD describes it as a stored cross-site scripting flaw in the Classic UI of Zimbra Collaboration Suite, abused through CSS @import directives in an HTML email.
Who is LAUNDRY BEAR?
A Russian state-supported group named by the Dutch AIVD and MIVD in May 2025. CISA and partners tie the Zimbra campaign to it in advisory AA26-204A.
Does the user have to click anything?
No. The advisory says the exploit only needs the user to view the malicious email in a vulnerable webmail version.
Which versions are fixed?
Zimbra released ZCS 10.0.18 and 10.1.13 on 6 November 2025 with the fix.
When was this flaw published and when was it exploited?
The advisory says use began around July 2025, Zimbra released a fix on 6 November 2025, NVD published the CVE on 5 January 2026, CISA listed it as exploited on 18 March 2026, and the advisory came on 23 July 2026.
What should I do if I find signs of compromise?
Per the advisory: find affected users with the indicators, revoke all Application Passcodes and 2FA scratch keys, and have staff change passwords.
In our research
- LAUNDRY BEAR Threat group
Sources
- Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite (AA26-204A) CISA and partner agencies
- CVE-2025-66376 record NIST National Vulnerability Database (API)
- Known Exploited Vulnerabilities Catalog (JSON feed) CISA
- Security Center Zimbra
- Zimbra Releases/10.0.18 Zimbra
- Zimbra Releases/10.1.13 Zimbra
- AIVD and MIVD identify new Russian cyber threat actor AIVD and MIVD (Netherlands)
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.