2026-07-24 · view entry permalink →
Russian state actor LAUNDRY BEAR weaponised a Zimbra webmail zero-click (CVE-2025-66376) for mailbox exfiltration — now exposed in a 16-nation joint advisory
Background. LAUNDRY BEAR — named by the Netherlands' AIVD/MIVD in May 2025, tracked as Void Blizzard by Microsoft, CL-STA-1114 by Unit 42 and TA488 (formerly UNK_PitStop) by Proofpoint — is a Russian state-supported espionage actor that, until this campaign, relied on password spraying, adversary-in-the-middle credential phishing (a modified Evilginx) and pass-the-cookie against Microsoft Exchange and cloud mail (CISA, 2026-07-23). The 2026-07-23 joint advisory AA26-204A, co-sealed by security and intelligence agencies from sixteen US, Five Eyes and EU-member nations including ANSSI/DGSI (France), AISE/AISI (Italy), AIVD/MIVD (Netherlands) and NCSC-UK, documents its shift to a genuinely technical exploit and assesses the covert, non-extortion nature of the activity as "almost certainly" Russian-government-backed espionage (CISA, 2026-07-23).
Since at least July 2025 the actor has exploited CVE-2025-66376, a stored cross-site-scripting flaw in the Zimbra Collaboration Suite (ZCS) Classic Web Client caused by improper sanitisation of CSS @import directives in HTML email (Unit 42, 2026-07-23). A crafted message smuggles a Base64-encoded, XOR-obfuscated JavaScript payload inside an SVG element's onload attribute; the script executes inside the victim's authenticated webmail session the moment the message is rendered. CISA describes this precisely as view-based — it "only requires a user to view a malicious email within a vulnerable version of the webmail service" (CISA, 2026-07-23) — while NCSC-UK and Unit 42 call it zero-click; with preview-pane rendering the practical effect is the same, and there is no link to click or attachment to open. It was a true zero-day when first used, and Synacor did not patch it until ZCS 10.0.18 / 10.1.13 in November 2025 — yet Unit 42 confirms attackers "continue to actively target unpatched ZCS instances" today (Unit 42, 2026-07-23). This is a third, distinct ZCS Classic Web Client flaw from the two unrelated July 2026 issues this store already tracks (the no-CVE code-exec fixed in 10.1.19 and the SNMP command-injection RCE fixed in 10.1.20).
Kill chain. On render, the payload ("Ulej", Russian for beehive) pulls the session CSRF token from browser localStorage and drives a 12-stage asynchronous collection routine over the Zimbra SOAP API: it retrieves the victim's last ~90 days of mail, brute-forces the organisation's Global Address List through repeated two-character SearchGalRequest batches (roughly twenty batches of ~77 queries), harvests GetScratchCodesRequest 2FA backup codes, and — the persistence pivot — issues CreateAppSpecificPasswordRequest to mint an IMAP application passcode (observed named ZimbraWeb) that bypasses ZCS's lack of native 2FA on IMAP, then flips zimbraPrefImapEnabled to true (CISA, 2026-07-23). Because that application passcode is a legitimate credential, it survives both the November patch and any subsequent password reset — as The Hacker News put it in its analysis, patching "stops the next crafted email from running. It does not revoke what the last one left behind" (The Hacker News, 2026-07-23). Exfiltration runs over both Base32-encoded DNS A-record queries and HTTPS to a Dockerised "Flowerbed" collection stack (Catcher/Certbot/Nginx/Gardener containers, Let's Encrypt via Cloudflare DNS challenge) on short-lived VPS infrastructure reached over Mullvad VPN; CISA notes the simplistic Flowerbed codebase shows indications of AI-assisted development. Since ~November 2025 the actor has also sent lures from already-compromised victim mailboxes, defeating sender-reputation filtering (CISA, 2026-07-23). Targeting spans the Defence Industrial Base, federal and local government, education, energy, law enforcement, media and NGOs across NATO states, with Ukraine used as an earlier testbed (NCSC-UK, 2026-07-23).
Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR's latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service.
A patch for CVE-2025-66376 was released for both 10.1.13 and 10.0.18 versions of ZCS.
Threat actors continue to actively target unpatched ZCS instances using CVE-2025-66376.