CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

LAUNDRY BEAR

actor · actor:laundry-bear

Russian state-supported email-espionage actor, named by the Netherlands' AIVD/MIVD in May 2025 (Void Blizzard per Microsoft, CL-STA-1114 per Unit 42, TA488 per Proofpoint). Historically reliant on password spraying, AiTM credential phishing (a modified Evilginx) and pass-the-cookie against Microsoft Exchange/cloud mail; from July 2025 it weaponised a Zimbra Collaboration Suite zero-click XSS (CVE-2025-66376) for large-scale mailbox/GAL/2FA-token exfiltration against NATO government, defence-industrial-base, energy, education, law-enforcement and NGO targets, using Ukraine as an earlier testbed. Subject of the joint advisory AA26-204A co-sealed by agencies from 16 nations (CISA/NSA/FBI and allied services, 2026-07-23).

Aliases: Void Blizzard, CL-STA-1114, TA488, UNK_PitStop

Coverage
3
2 about it · 1 mention · first 2026-05-18 → last 2026-10-21
Latest activity
2026-07-31
Exchange OWA flaw used in Russia-aligned espionage is fixed since June 2026, but its mailbox foothold needs…
Peak priority
high
2 high
Targets
public-sector
sectors: public-sector, telco, finance · regions: europe, us
Sources cited
17
12 hosts
2026-05-183 appearances2026-07-25

Action items (5)

Do-now tasks recorded on the entries about LAUNDRY BEAR, newest first. Check the date before acting on an older one.

  • Install the July 2026 Exchange Security Update on every on-premises Exchange 2016/2019/SE server, then explicitly remove the earlier CVE-2026-42897 mitigation, the EEMS M2.1.0 IIS rules or the EOMT script rollback, because the update does not remove either automatically.
    2026-05-18CVE-2026-42897
  • Audit mailbox folder permissions across the estate for Owner-level grants to the Exchange 'Default' alias and revoke them; this is the implant's server-side persistence and it survives password resets and endpoint re-imaging.
    2026-05-18CVE-2026-42897
  • Confirm every on-prem Zimbra Collaboration Suite instance is on ZCS ≥ 10.0.18 or ≥ 10.1.13 specifically for CVE-2025-66376; this is a distinct patch from the ZCS 10.1.19 and 10.1.20 fixes tracked earlier this month.
    2026-07-24CVE-2025-66376
  • On any ZCS account suspected of exposure, revoke all application-specific passwords and regenerate 2FA scratch codes, then disable IMAP where it is not required, patching stops the next crafted email but does not revoke access an earlier one already established.
    2026-07-24CVE-2025-66376
  • On any Zimbra account touched by the CVE-2025-66376 campaign, revoke application-specific passwords via the admin console, not just reset the user password: the attacker-created 'ZimbraWeb' app-password survives a password reset and the patch and grants standalone IMAP/POP3/SMTP mailbox access.
    2026-07-24CVE-2025-66376

Defender insights

What each entry about LAUNDRY BEAR tells a defender to do, newest first.

2026-05-18HIGHexploitedExchange OWA flaw used in Russia-aligned espionage is fixed since June 2026, but its mailbox foothold needs removing

Exposure

2026-07-24HIGHexploited16-nation advisory: Russia's LAUNDRY BEAR exfiltrates government mail through a view-based Zimbra exploit, and patching alone does not evict it

Latest update · triage

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

uses

attributed activity

Story timeline

Every entry that names LAUNDRY BEAR, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

  1. 2026-07-25TA458 / Operation RoundPress: a running supply of half-click webmail zero-days adds a fresh SOGo flaw (CVE-2026-8496)
    mentiondeep-diveGRU-assessed TA458 keeps a live half-click zero-day supply across five self-hosted webmail platforms
  2. 2026-07-24Russian state actor LAUNDRY BEAR weaponised a Zimbra webmail zero-click (CVE-2025-66376) for mailbox exfiltration, now exposed in a 16-nation joint advisory
    deep-dive16-nation advisory: Russia's LAUNDRY BEAR exfiltrates government mail through a view-based Zimbra exploit, and patching alone does not evict it
  3. 2026-05-18CVE-2026-42897: Exchange OWA cross-site scripting exploited by TA488 with the OWAReaper implant; fixed since the June 2026 Security Update, which does not remove the mitigation
    trending-vulnerabilitiesExchange OWA flaw used in Russia-aligned espionage is fixed since June 2026, but its mailbox foothold needs removing

Hunting pivots

CVEs (exploited first)
CVE-2025-66376CVE-2026-42897
Affected products
Microsoft Exchange Server 2016Microsoft Exchange Server 2019Microsoft Exchange Server Subscription EditionZimbra Collaboration SuiteZimbra Collaboration Suite (Classic Web Client)
Tags
actively-exploited ×2cisa-kev ×2espionage ×2identity ×2nation-state ×2ai-abusepatch-availablephishingrussia-nexusvulnerabilitieszero-click
ATT&CK techniques (19 across 12 tactics)

19 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Resource DevelopmentStage Capabilities
  • Initial AccessPhishing
  • ExecutionCommand and Scripting Interpreter: JavaScript · Exploitation for Client Execution
  • PersistenceAccount Manipulation · Account Manipulation: Additional Email Delegate Permissions · Modify Authentication Process: Multi-Factor Authentication
  • Privilege EscalationAccount Manipulation · Account Manipulation: Additional Email Delegate Permissions
  • StealthObfuscated Files or Information · Obfuscated Files or Information: SVG Smuggling
  • Defense ImpairmentModify Authentication Process: Multi-Factor Authentication
  • Credential AccessSteal Application Access Token · Steal Web Session Cookie · Credentials from Password Stores: Credentials from Web Browsers · Modify Authentication Process: Multi-Factor Authentication
  • DiscoveryAccount Discovery: Email Account
  • CollectionEmail Collection: Remote Email Collection · Browser Session Hijacking
  • Command and ControlApplication Layer Protocol: Web Protocols · Application Layer Protocol: DNS · Web Service: Dead Drop Resolver
  • ExfiltrationExfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Resource Development TA0042

T1608Stage Capabilities×1

Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

Initial Access TA0001

T1566Phishing×2

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · 2026-05-18/cve-2026-42897-exchange-owa-em-service-auto-mitigation-depen · ATT&CK page ↗

Execution TA0002

T1059.007Command and Scripting Interpreter: JavaScript×1

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

T1203Exploitation for Client Execution×2

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · 2026-05-18/cve-2026-42897-exchange-owa-em-service-auto-mitigation-depen · ATT&CK page ↗

Persistence TA0003

T1098Account Manipulation×1

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

T1098.002Account Manipulation: Additional Email Delegate Permissions×1

Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.

Evidence: 2026-05-18/cve-2026-42897-exchange-owa-em-service-auto-mitigation-depen · ATT&CK page ↗

T1556.006Modify Authentication Process: Multi-Factor Authentication×1

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

Privilege Escalation TA0004

T1098Account Manipulation×1

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

T1098.002Account Manipulation: Additional Email Delegate Permissions×1

Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.

Evidence: 2026-05-18/cve-2026-42897-exchange-owa-em-service-auto-mitigation-depen · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-05-18/cve-2026-42897-exchange-owa-em-service-auto-mitigation-depen · ATT&CK page ↗

T1027.017Obfuscated Files or Information: SVG Smuggling×1

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files. SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include `<script>` tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

Defense Impairment TA0112

T1556.006Modify Authentication Process: Multi-Factor Authentication×1

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

Credential Access TA0006

T1528Steal Application Access Token×1

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Evidence: 2026-05-18/cve-2026-42897-exchange-owa-em-service-auto-mitigation-depen · ATT&CK page ↗

T1539Steal Web Session Cookie×1

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

T1555.003Credentials from Password Stores: Credentials from Web Browsers×1

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-05-18/cve-2026-42897-exchange-owa-em-service-auto-mitigation-depen · ATT&CK page ↗

T1556.006Modify Authentication Process: Multi-Factor Authentication×1

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

Discovery TA0007

T1087.003Account Discovery: Email Account×1

Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

Collection TA0009

T1114.002Email Collection: Remote Email Collection×1

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

T1185Browser Session Hijacking×1

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

Evidence: 2026-05-18/cve-2026-42897-exchange-owa-em-service-auto-mitigation-depen · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-05-18/cve-2026-42897-exchange-owa-em-service-auto-mitigation-depen · ATT&CK page ↗

T1071.004Application Layer Protocol: DNS×2

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · 2026-05-18/cve-2026-42897-exchange-owa-em-service-auto-mitigation-depen · ATT&CK page ↗

T1102.001Web Service: Dead Drop Resolver×1

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

Evidence: 2026-05-18/cve-2026-42897-exchange-owa-em-service-auto-mitigation-depen · ATT&CK page ↗

Exfiltration TA0010

T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol×1

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Evidence: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376 · ATT&CK page ↗

Entries about LAUNDRY BEAR (2)

2026-05-18 · view entry permalink →

HIGHCVE-2026-42897exploitedupdatedNATOA1

CVE-2026-42897: Exchange OWA cross-site scripting exploited by TA488 with the OWAReaper implant; fixed since the June 2026 Security Update, which does not remove the mitigation

CVE-2026-42897 is a cross-site scripting flaw in Outlook Web Access on Exchange Server 2016, 2019 and Subscription Edition; Microsoft scores it 8.1, marks it exploited (Microsoft Security Response Center, 2026-07-14), and CISA added it to its Known Exploited Vulnerabilities catalog on 2026-05-15 (CISA KEV catalog, 2026-05-15). Exchange Online is not affected (Microsoft Exchange Team Blog, 2026-05-14). Microsoft first protected on-premises servers with mitigation M2, a URL Rewrite configuration delivered by the Exchange Emergency Mitigation Service (Microsoft Learn). The EM service runs on Mailbox servers (installed with the September 2021 CU or later) and needs outbound HTTPS to officeclient.microsoft.com, which must also be excluded from SSL inspection; servers that cannot reach it never receive the mitigation, and Get-ExchangeServer | Format-List Name,MitigationsApplied shows what each server has applied (Microsoft Learn). A server running an Exchange Server build older than March 2023 cannot check for new mitigations at all (Microsoft Exchange Team Blog, 2026-05-14).

The fix shipped in the June 2026 Security Update (Microsoft Exchange Team Blog, 2026-06-09), and Microsoft recommends the July 2026 Security Update, which also addresses the related CVE-2026-55008; installing either does not remove the earlier mitigation, which stays in place until administrators remove it by hand (Microsoft Exchange Team Blog, 2026-06-09) (Microsoft Exchange Team Blog, 2026-07-14) (Microsoft Security Response Center, 2026-07-14). From 2026-07-22 Proofpoint observed TA488 (Void Blizzard, LAUNDRY BEAR) exploiting the flaw against government, telecommunications, finance, hospitality and aerospace targets in the US and Europe with the OWAReaper implant, whose server-side persistence survives password resets and re-imaging (Proofpoint, 2026-07-29); the update below carries the detail.

The Exchange Emergency Mitigation Service will provide mitigation automatically, and is on by default.

Microsoft Security Response Center 2026-07-14

The messages exploit CVE-2026-42897, a vulnerability in Outlook Web Access in which the server does not adequately sanitize HTML in the message body. This allows a loader piece of JavaScript to use the onload= event handler to parse the rest of the message body, assemble a Base64 fragment, and execute it as encoded JavaScript.

This persistent access lives on the server-side and requires deliberate removal from the Exchange server; credential rotation and even full re-imaging of the targeted user's device will not evict the actor.

Proofpoint 2026-07-29

Installing the July 2026 update does not automatically remove already applied CVE-2026-42897 mitigations.

Please note that EM Service will not be able to check for new mitigations if your server is running Exchange Server version older than March 2023

Microsoft Exchange Team Blog 2026-05-14
Updaterun 2026-07-31T0409Z-intelactionsaffected_productscvesentitiesevidencereferencesregionssectorssourcestagstechniquesbody

CVE-2026-42897 was first an Exchange OWA flaw whose interim protection depended on the EM Service auto-mitigation. Two things changed. Proofpoint has now attributed in-the-wild exploitation to a named Russia-aligned actor and published the implant's full mechanics (Proofpoint, 2026-07-29), and the mitigation is no longer the remediation: the security updates are, with the mitigation now something Microsoft says administrators should remove (Microsoft Exchange Team Blog, 2026-07-14). NCSC-CH appended the Proofpoint reporting to its own advisory on 2026-07-30 (NCSC Switzerland, 2026-07-30).

The actor is TA488 (also tracked as Void Blizzard and LAUNDRY BEAR), the Russia-aligned email-espionage actor behind the Zimbra campaign that Proofpoint documented in a joint release with the NSA (Proofpoint, 2026-07-29). Proofpoint assesses OWAReaper as an evolution of that campaign's ZimReaper payload, citing shared code including the same sized, invisible pop-up and highly similar error handling (Proofpoint, 2026-07-29). Campaign activity began 2026-07-22 against government, telecommunications, finance, hospitality and aerospace targets across the US and Europe, using deliberately banal lure subjects with no call to action; Proofpoint says the unusual breadth may have been intentional blending with bulk mail. Its stated infrastructure-creation date of March 2026 precedes Microsoft's May disclosure by two months, which is the basis for its assessment that zero-day use is feasible; that is an inference from infrastructure dating, not a confirmed finding.

Execution. The flaw is a failure to sanitise HTML in the message body, so a loader script in an onload= handler reassembles a Base64 fragment from the rest of the message and evaluates it: no link click and no attachment open, only viewing the message in OWA. The exploit and payload fragments are hidden inside the message's social-media icon elements, with next-stage data placed after # fragment markers where the browser's Base64 image parser stops reading, so the payload is not visible to casual inspection of the HTML. On execution OWAReaper first rewrites the delivered message server-side to strip the exploit content and suppresses OWA pop-ups and right-click, then enumerates the victim's address, username and settings (Proofpoint, 2026-07-29).

Credential and token theft. It creates two invisible input elements and waits for the browser's own autofill to populate them with the saved OWA username and password. Separately it enumerates installed Outlook add-ins holding ReadWriteMailbox permission and, where one exists, abuses it to call GetClientAccessToken and obtain OAuth tokens (Proofpoint, 2026-07-29).

Persistence, in three independent layers. Client-side, the implant writes an encrypted copy of itself and a decryption wrapper into browser localStorage under a settings field of the legitimate PageDataPayload.OwaUserDefaultSettings key, which OWA itself evaluates during its own sync-restore flow, so every ordinary OWA tab-open re-launches it with no separate loader. A second client-side layer adds a hidden iframe to messages cached in OWA's offline IndexedDB store, so opening the cached message re-infects an endpoint even after a full re-image. The third is server-side and is the one that matters most: the implant calls UpdateFolder to grant Owner-level permission on every mail folder to the low-privilege "Default" preset alias that exists in every Exchange organisation. Proofpoint is explicit that this "requires deliberate removal from the Exchange server" and that credential rotation and re-imaging will not evict it (Proofpoint, 2026-07-29).

Command and control. Two channels, both over infrastructure defenders generally trust. The implant polls GitHub's public Commit Search API every 24 hours for crafted commit messages containing the target's own email address, decrypting matches to a four-character command header that selects toolkit replacement, C2-domain rotation, or one-off code execution; in parallel it re-parses cached inbound messages every five minutes for the same command structure. Exfiltration runs primarily over HTTPS with encrypted URI paths, either relayed through a set of legitimate image-CDN domains or sent directly to the actor-controlled server when those proxies fail; if the HTTPS method fails altogether, the implant switches to DNS label tunnelling, packing the data into the subdomain labels of ordinary DNS queries for an actor-controlled domain. Notably, Proofpoint states there is no mass mailbox exfiltration here, unlike the Zimbra campaign, so the mapped behaviour is browser-session and credential access rather than bulk email collection (Proofpoint, 2026-07-29).

Patching. The fix first shipped in the June 2026 Security Update (Microsoft Exchange Team Blog, 2026-06-09), and Microsoft now recommends the July 2026 Security Update, available as Exchange SE RTM publicly and for Exchange 2019 CU14/CU15 and Exchange 2016 CU23 only through the Period 2 Extended Security Update programme; organisations that were enrolled only in Period 1, which ended in April 2026 (Microsoft Exchange Team Blog, 2026-05-14), do not receive it (Microsoft Exchange Team Blog, 2026-07-14). Microsoft's own vulnerability record scores the flaw 8.1 and marks it exploited (Microsoft Security Response Center, 2026-07-14). Installing the update does not remove a previously applied mitigation: administrators who used the EM Service should remove the M2.1.0 IIS rules through the documented rollback, and those who ran the downloadable mitigation script should run its rollback (Microsoft Exchange Team Blog, 2026-07-14). The known operational side effects of the mitigation era (broken OWA calendar printing, inline-image rendering problems, OWA-light failing, and false-unhealthy calendar-proxy health alerts) are listed in the May post (Microsoft Exchange Team Blog, 2026-05-14), and the July post ties their clearing to installing the update and removing the mitigation (Microsoft Exchange Team Blog, 2026-07-14).

Triage: OWA legitimately reads and writes its own settings keys constantly, so the presence of localStorage activity is not the signal; the discriminator is the specific settings-field path carrying an encrypted blob, and its correlation with a message open. For the server-side artifact the discrimination is cleaner: administrators do grant folder permissions, but they grant them to named users or groups for a specific folder, not Owner rights to the built-in "Default" alias across an entire mailbox. Treat any such grant as compromise until proven otherwise.

Improvementrun 2026-08-30T1312Z-auditactionsclassification

The sourcing is the vendor's own advisory for its own product, independently corroborated: Proofpoint analysed the implant separately from Microsoft's disclosure, and NCSC-CH's post added a link to Proofpoint's analysis. Nothing in the assessment or the remediation guidance changed.

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummarypriorityimmediate_actiontagscvessourcesevidencesourcing_noteactionsbodyevent_datesectors

The EM service fetches mitigations from officeclient.microsoft.com over port 443, runs only on Mailbox servers, and reports applied mitigations through Get-ExchangeServer | Format-List Name,MitigationsApplied (Microsoft Learn); the earlier host name and Edge Transport cmdlet had no source. The fix first shipped in the June 2026 Security Update (Microsoft Exchange Team Blog, 2026-06-09), a month before the July update Microsoft now recommends (Microsoft Exchange Team Blog, 2026-07-14). Proofpoint describes its July 2026 report on the actor's Zimbra campaign as a joint release with the NSA (Proofpoint, 2026-07-29).

Improvementrun 2026-10-21T1149Z-auditbodyevidencetechniquesheadline

The Exchange Emergency Mitigation Service cannot check for new mitigations on a server running an Exchange Server build older than March 2023 (Microsoft Exchange Team Blog, 2026-05-14), so such a server did not receive mitigation M2 automatically.

Builds on: 16-nation advisory: Russia's LAUNDRY BEAR exfiltrates government mail through a view-based…

vulnerability18 May 05:00Zmulti-sourceOpen finding →
Sources: Microsoft Exchange Team Blog · Microsoft Learn · Microsoft Security Response Center · CISA KEV catalog · Proofpoint · NCSC Switzerland (Cyber Security Hub)

2026-07-24 · view entry permalink →

HIGHCVE-2025-66376exploitedupdatedNATOA1

Russian state actor LAUNDRY BEAR weaponised a Zimbra webmail zero-click (CVE-2025-66376) for mailbox exfiltration, now exposed in a 16-nation joint advisory

Background. LAUNDRY BEAR; named by the Netherlands' AIVD/MIVD in May 2025, tracked as Void Blizzard by Microsoft, CL-STA-1114 by Unit 42 and TA488 (formerly UNK_PitStop) by Proofpoint, is a Russian state-supported espionage actor that, until this campaign, relied on password spraying, adversary-in-the-middle credential phishing (a modified Evilginx) and pass-the-cookie against Microsoft Exchange and cloud mail (CISA, 2026-07-23). The 2026-07-23 joint advisory AA26-204A, co-sealed by security and intelligence agencies from sixteen US, Five Eyes and EU-member nations including ANSSI/DGSI (France), AISE/AISI (Italy), AIVD/MIVD (Netherlands) and NCSC-UK, documents its shift to a genuinely technical exploit and assesses the covert, non-extortion nature of the activity as "almost certainly" Russian-government-backed espionage (CISA, 2026-07-23).

Since at least July 2025 the actor has exploited CVE-2025-66376, a stored cross-site-scripting flaw in the Zimbra Collaboration Suite (ZCS) Classic Web Client caused by improper sanitisation of CSS @import directives in HTML email (Unit 42, 2026-07-23). A crafted message smuggles a Base64-encoded, XOR-obfuscated JavaScript payload inside an SVG element's onload attribute; the script executes inside the victim's authenticated webmail session the moment the message is rendered. CISA describes this precisely as view-based; it "only requires a user to view a malicious email within a vulnerable version of the webmail service" (CISA, 2026-07-23), while NCSC-UK and Unit 42 call it zero-click; with preview-pane rendering the practical effect is the same, and there is no link to click or attachment to open. It was a true zero-day when first used, and Synacor did not patch it until ZCS 10.0.18 / 10.1.13 in November 2025, yet Unit 42 confirms attackers "continue to actively target unpatched ZCS instances" today (Unit 42, 2026-07-23). This is a third, distinct ZCS Classic Web Client flaw from the two unrelated July 2026 issues this store already tracks (the no-CVE code-exec fixed in 10.1.19 and the SNMP command-injection RCE fixed in 10.1.20).

Kill chain. On render, the payload ("Ulej", Russian for beehive) pulls the session CSRF token from browser localStorage and drives a 12-stage asynchronous collection routine over the Zimbra SOAP API: it retrieves the victim's last ~90 days of mail, brute-forces the organisation's Global Address List through repeated two-character SearchGalRequest batches (roughly twenty batches of ~77 queries), harvests GetScratchCodesRequest 2FA backup codes, and (the persistence pivot) issues CreateAppSpecificPasswordRequest to mint an IMAP application passcode (observed named ZimbraWeb) that bypasses ZCS's lack of native 2FA on IMAP, then flips zimbraPrefImapEnabled to true (CISA, 2026-07-23). Because that application passcode is a legitimate credential, it survives both the November patch and any subsequent password reset, as The Hacker News put it in its analysis, patching "stops the next crafted email from running. It does not revoke what the last one left behind" (The Hacker News, 2026-07-23). Exfiltration runs over both Base32-encoded DNS A-record queries and HTTPS to a Dockerised "Flowerbed" collection stack (Catcher/Certbot/Nginx/Gardener containers, Let's Encrypt via Cloudflare DNS challenge) on short-lived VPS infrastructure reached over Mullvad VPN; CISA notes the simplistic Flowerbed codebase shows indications of AI-assisted development. Since ~November 2025 the actor has also sent lures from already-compromised victim mailboxes, defeating sender-reputation filtering (CISA, 2026-07-23). Targeting spans the Defence Industrial Base, federal and local government, education, energy, law enforcement, media and NGOs across NATO states, with Ukraine used as an earlier testbed (NCSC-UK, 2026-07-23).

Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR's latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service.

A patch for CVE-2025-66376 was released for both 10.1.13 and 10.0.18 versions of ZCS.

CISA / NSA / FBI + allied agencies from 16 nations (joint CSA AA26-204A) 2026-07-23

Threat actors continue to actively target unpatched ZCS instances using CVE-2025-66376.

Palo Alto Networks Unit 42 2026-07-23

the sanitizer fails to recognize it as executable markup, while the browser successfully reconstructs <svg onload="eval(atob('…'))"> and executes it.

Proofpoint has not observed TA458 using CVE-2025-66376, despite the group's regular access to webmail XSS zero-days.

Proofpoint Threat Research
Updaterun 2026-07-25T0409Z-intelactionsaffected_productsevidencereferencestagstechniquesbody

The prior entry covered the 16-nation joint advisory (AA26-204A) on LAUNDRY BEAR's (TA488 / Void Blizzard) zero-click Zimbra campaign exploiting CVE-2025-66376. Proofpoint's own two-part writeup adds mechanics the advisory did not detail (Proofpoint, 2026-07-23).

The exploit defeats Zimbra's client-side HTML sanitizer by tag-splitting: a fake CSS @import directive is fragmented across HTML tags so that the sanitizer strips each @import sequence individually, but "the browser successfully reconstructs <svg onload="eval(atob('…'))"> and executes it", a sanitizer-bypass-by-reassembly, where the surviving characters rejoin into valid executing script (Proofpoint, 2026-07-23). The resulting payload (which Proofpoint attributes to LAUNDRY BEAR's post-exploitation tooling and names ZimReaper) steals CSRF tokens, browser-autofill credentials, 2FA scratch codes and the Zimbra version/URL, exfiltrating tokens via DNS tunneling (Base32-encoded subdomains carrying a session id and a plaintext token-type label) and mail archives via HTTP POST.

The operationally important delta is persistence: after exploitation ZimReaper issues a CreateAppSpecificPasswordRequest to mint a Zimbra application-specific password labelled "ZimbraWeb" that bypasses 2FA and grants IMAP/POP3/SMTP access, then exfiltrates it via DNS for direct mailbox access (Proofpoint, 2026-07-23). Because that credential is independent of the primary account password, it survives a password reset and the CVE-2025-66376 patch alike.

Builds on: GRU-assessed TA458 keeps a live half-click zero-day supply across five self-hosted webmail…

threat24 Jul 04:36Zmulti-sourceOpen finding →
Sources: CISA / NSA / FBI + allied agencies from 16 nations (joint CSA AA26-204A) · NCSC-UK · Palo Alto Networks Unit 42 · Proofpoint · The Record (Recorded Future News)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Deep dive2
  • Vulns1

Source distribution

  • proofpoint.com3 (18%)
  • techcommunity.microsoft.com3 (18%)
  • cisa.gov2 (12%)
  • github.com1 (6%)
  • learn.microsoft.com1 (6%)
  • msrc.microsoft.com1 (6%)
  • ncsc.gov.uk1 (6%)
  • security-hub.ncsc.admin.ch1 (6%)
  • other4 (24%)
All cited sources (17)