Russian state actor LAUNDRY BEAR weaponised a Zimbra webmail zero-click (CVE-2025-66376) for mailbox exfiltration, now exposed in a 16-nation joint advisory

Background. LAUNDRY BEAR; named by the Netherlands' AIVD/MIVD in May 2025, tracked as Void Blizzard by Microsoft, CL-STA-1114 by Unit 42 and TA488 (formerly UNK_PitStop) by Proofpoint, is a Russian state-supported espionage actor that, until this campaign, relied on password spraying, adversary-in-the-middle credential phishing (a modified Evilginx) and pass-the-cookie against Microsoft Exchange and cloud mail (CISA, 2026-07-23). The 2026-07-23 joint advisory AA26-204A, co-sealed by security and intelligence agencies from sixteen US, Five Eyes and EU-member nations including ANSSI/DGSI (France), AISE/AISI (Italy), AIVD/MIVD (Netherlands) and NCSC-UK, documents its shift to a genuinely technical exploit and assesses the covert, non-extortion nature of the activity as "almost certainly" Russian-government-backed espionage (CISA, 2026-07-23).

Since at least July 2025 the actor has exploited CVE-2025-66376, a stored cross-site-scripting flaw in the Zimbra Collaboration Suite (ZCS) Classic Web Client caused by improper sanitisation of CSS @import directives in HTML email (Unit 42, 2026-07-23). A crafted message smuggles a Base64-encoded, XOR-obfuscated JavaScript payload inside an SVG element's onload attribute; the script executes inside the victim's authenticated webmail session the moment the message is rendered. CISA describes this precisely as view-based; it "only requires a user to view a malicious email within a vulnerable version of the webmail service" (CISA, 2026-07-23), while NCSC-UK and Unit 42 call it zero-click; with preview-pane rendering the practical effect is the same, and there is no link to click or attachment to open. It was a true zero-day when first used, and Synacor did not patch it until ZCS 10.0.18 / 10.1.13 in November 2025, yet Unit 42 confirms attackers "continue to actively target unpatched ZCS instances" today (Unit 42, 2026-07-23). This is a third, distinct ZCS Classic Web Client flaw from the two unrelated July 2026 issues this store already tracks (the no-CVE code-exec fixed in 10.1.19 and the SNMP command-injection RCE fixed in 10.1.20).

Kill chain. On render, the payload ("Ulej", Russian for beehive) pulls the session CSRF token from browser localStorage and drives a 12-stage asynchronous collection routine over the Zimbra SOAP API: it retrieves the victim's last ~90 days of mail, brute-forces the organisation's Global Address List through repeated two-character SearchGalRequest batches (roughly twenty batches of ~77 queries), harvests GetScratchCodesRequest 2FA backup codes, and (the persistence pivot) issues CreateAppSpecificPasswordRequest to mint an IMAP application passcode (observed named ZimbraWeb) that bypasses ZCS's lack of native 2FA on IMAP, then flips zimbraPrefImapEnabled to true (CISA, 2026-07-23). Because that application passcode is a legitimate credential, it survives both the November patch and any subsequent password reset, as The Hacker News put it in its analysis, patching "stops the next crafted email from running. It does not revoke what the last one left behind" (The Hacker News, 2026-07-23). Exfiltration runs over both Base32-encoded DNS A-record queries and HTTPS to a Dockerised "Flowerbed" collection stack (Catcher/Certbot/Nginx/Gardener containers, Let's Encrypt via Cloudflare DNS challenge) on short-lived VPS infrastructure reached over Mullvad VPN; CISA notes the simplistic Flowerbed codebase shows indications of AI-assisted development. Since ~November 2025 the actor has also sent lures from already-compromised victim mailboxes, defeating sender-reputation filtering (CISA, 2026-07-23). Targeting spans the Defence Industrial Base, federal and local government, education, energy, law enforcement, media and NGOs across NATO states, with Ukraine used as an earlier testbed (NCSC-UK, 2026-07-23).