Article
TikTok Suffered A Data Breach Resulting In The Leak Of 2 Billion User Data
The source codes of the popular social media application TikTok and the sharing claiming that 2 Billion user data have been seized.
Read more
Malware profile
Ulej
Also known as Улей, Beehive, Flowerbed
In short
Ulej (Russian for beehive) is a custom data theft capability that the joint advisory AA26-204A describes as used by the Russian state-supported group LAUNDRY BEAR against Zimbra Collaboration Suite webmail. When a user views a malicious email in a vulnerable version, it attempts to send the last 90 days of email, the address directory and account secrets to servers running a collection framework called Flowerbed.
- Names8names in public reportsUlej · Улей · Beehive
- Techniques20ATT&CK techniques listedReconnaissance · Resource Development · Initial Access
- Infection Steps7in the delivery chainServer set up · Email sent
- Linked Groups1groups that use itLAUNDRY BEAR
In one minute
- What it is
- A custom data theft capability for Zimbra webmail (Ulej, Russian for beehive), paired with the Flowerbed server framework that receives the stolen data.
- What it does
- Attempts to steal the last 90 days of email, the organization address directory, saved passwords and 2FA codes, and to create an app passcode for lasting access.
- Who uses it
- Attributed by CISA, NSA, FBI and partner agencies (23 July 2026) to LAUNDRY BEAR, which they call a Russian state-supported group. NCSC-UK says the campaign is almost certainly carried out with Russian state support.
- How it gets in
- A malicious email viewed in a vulnerable ZCS webmail (CVE-2025-66376). The user does not need to click anything.
- What to do first
- Update ZCS to a patched version (10.1.13 or 10.0.18 or later) and look for app passcodes named ZimbraWeb.
What it does
The advisory says Ulej is built to exploit CVE-2025-66376 in Zimbra webmail, but likely could be adapted to exploit other vulnerabilities. NCSC-UK calls it a zero-click exploit, because the user only has to view the email.
The stolen data goes to Flowerbed, a Python project on a rented server. The advisory says these servers are typically only used for 7-60 days before the actors move to new infrastructure, and that there are indications that AI played a role in writing the simple Flowerbed code.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| Ulej | Name of the data theft capability in CISA advisory AA26-204A[1] |
| Улей | Russian spelling given in AA26-204A, meaning beehive[1] |
| Beehive | English name used by NCSC-UK for the same zero-click exploit[2] |
| Flowerbed | The collection framework that receives data from Ulej (AA26-204A)[1] |
| Catcher | Flowerbed container that receives and aggregates stolen data over DNS and HTTP[1] |
| Certbot | Flowerbed container that automates certificate generation[1] |
| Nginx | Flowerbed container that works as an HTTPS reverse proxy for Catcher[1] |
| Gardener | Flowerbed container that checks that Catcher works[1] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Reconnaissance
Resource Development
Develop Capabilities: Malware T1587.001
Ulej is a new payload built to steal a victim's email and other account information.[1]
Develop Capabilities: Exploits T1587.004
The cross-site-scripting exploit was new when first used and lets arbitrary JavaScript run.[1]
Obtain Capabilities: Artificial Intelligence T1588.007
The group appears to have used AI to help with development.[1]
Stage Capabilities T1608
Flowerbed is deployed to a server bought in the cloud.[1]
Initial Access
Execution
Persistence
Stealth
Collection
Email Collection: Remote Email Collection T1114.002
Email is pulled through API calls to the ZCS mail server, not from the victim's device.[1]
Automated Collection T1119
When it runs, the payload collects the relevant data by itself, in stages.[1]
Browser Session Hijacking T1185
It uses the user's logged-in browser session to make API requests as that user.[1]
Data Staged: Remote Data Staging T1074.002
Stolen data goes to a server controlled by the actors before it is moved to assumed long-term storage.[1]
Archive Collected Data T1560
Emails are sent out as GZIP compressed archives.[1]
Discovery
Exfiltration
Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.002
Larger payloads were sent over HTTPS.[1]
Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol T1048.003
Smaller payloads were sent over DNS using Base32 encoding.[1]
How it spreads
Ulej does not spread by itself. CISA and its partners say LAUNDRY BEAR sends an email with a malicious JavaScript payload to the target, and the payload runs once the user views the email in vulnerable ZCS webmail. Since at least November 2025 the actors have sent these emails from compromised accounts, which the advisory says were likely earlier victims. The advisory says the group likely picks victim organizations by hand.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Server set up
The actors buy a rented server and an automated process deploys the Flowerbed Docker containers on it.[1]
Email sent
LAUNDRY BEAR sends an email with a malicious JavaScript payload hidden in an SVG element. Since at least November 2025 it has been sent from compromised accounts.[1]
Email viewed
The user views the email in a vulnerable ZCS webmail. CVE-2025-66376 lets the JavaScript run at once, with no click.[1, 5]
Payload unpacks
The outer script decodes and decrypts the inner script, which then runs 12 asynchronous stages of collection and exfiltration.[1]
Access secured
The script tries to turn on IMAP, create an Application Passcode named ZimbraWeb and read the user's 2FA scratch codes.[1]
Data sent out
It pulls up to 90 days of email and the address directory, then sends data to Flowerbed over DNS and HTTPS.[1]
Data passed on
Catcher stores the data. About every 60 seconds an automated SSH connection moves it to non-public infrastructure.[1]
Timeline
- July 2025
Campaign begins
The advisory says LAUNDRY BEAR has targeted ZCS users since at least July 2025, using what was then a zero-day exploit.[1]
- November 2025
Patch released
The advisory says CVE-2025-66376 was patched in November 2025.[1]
- 5 January 2026
CVE published
NVD lists CVE-2025-66376, a stored cross-site scripting flaw in the ZCS Classic UI, as published.[5]
- 18 March 2026
Added to the KEV catalog
NVD records that CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities catalog on this date.[5]
- 23 July 2026
- 23 July 2026
- August 3, 2026
CERT-EU Cyber Brief 26-08
CERT-EU reports the CISA finding on the Zimbra phishing campaign in its July 2026 brief.[4]
Who uses it
Seen in
Detection and defense
Questions
What is Ulej?
Ulej (Russian for beehive) is a custom capability that CISA and partner agencies say LAUNDRY BEAR used to steal email and account data from Zimbra Collaboration Suite webmail users. The advisory says it exploits CVE-2025-66376.
What is Flowerbed?
Flowerbed is the Python and Docker framework that receives the data Ulej sends out. It has four containers: Catcher, Certbot, Nginx and Gardener.
Does the victim have to click anything?
No. The advisory says the exploit only requires the user to view a malicious email in a vulnerable version of the webmail service.
Which ZCS versions are affected?
NVD lists ZCS 10 before 10.0.18 and 10.1 before 10.1.13 as affected by CVE-2025-66376.
What does Ulej try to take?
The advisory lists the last 90 days of email, the email address, the password, the Global Address List, 2FA tokens and a newly created Application Passcode.
In our research
- TikTok Suffered A Data Breach Resulting In The Leak Of 2 Billion User Data September 2022
- LAUNDRY BEAR Threat group
Sources
- Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite (AA26-204A) CISA, with NSA, FBI and partnersSupports: Ulej, the Flowerbed framework and its four containers, techniques, mitigations and indicators.
- UK and partners expose Russian state-supported actors for new 'zero-click' phishing campaign targeting Western organisations NCSC-UKSupports: The "beehive" (Ulej) zero-click exploit, the espionage assessment, AI role and 23 July 2026 date.
- Joint cyber security advisory on Russian state-sponsored phishing campaign targeting Zimbra webmail Canadian Centre for Cyber SecuritySupports: Canada joins the advisory; Laundry Bear exploiting a Zimbra webmail vulnerability.
- Cyber Brief 26-08 - July 2026 CERT-EUSupports: CERT-EU report of the CISA finding on the Laundry Bear campaign against Zimbra webmail.
- CVE-2025-66376 NIST National Vulnerability DatabaseSupports: Affected ZCS versions, flaw type, publication date and CISA KEV listing.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.