A Russian state-backed hacking group is actively exploiting a Zimbra webmail vulnerability that needs nothing more than a user opening a malicious email — no click, no download — to begin siphoning the past 90 days of messages, the organization’s entire address book, and multi-factor authentication recovery codes. The U.S. Cybersecurity and Infrastructure Security Agency, together with more than a dozen international partners, released a joint advisory on July 23, 2026, detailing a campaign attributed to LAUNDRY BEAR (also tracked as Void Blizzard, CL-STA-1114, and TA488) that has been running since at least July 2025.

The bug, tagged CVE-2025-66376, is a stored cross‑site scripting flaw in the Zimbra Collaboration Suite Classic UI. Synacor, the developer of Zimbra, patched it in November 2025 with versions 10.0.18 and 10.1.13, but the advisory confirms the exploit was a zero‑day when it first appeared. That means organizations that delayed patching have had attackers inside their mailboxes for months.

The One‑Preview Attack: How It Works

The core mechanism is deceptively simple. An attacker crafts an HTML email containing a malicious JavaScript payload hidden inside a Scalable Vector Graphics element, using mis‑sanitized CSS @import directives to trigger execution. When a user views the message in the Zimbra Classic web interface, the script runs with the full authority of the user’s authenticated session.

This is not a traditional phishing lure. There is no link to click, no attachment to open, no request to enter credentials. The mere act of reading or previewing the email is enough to launch the attack. “It’s a view‑based exploit,” the advisory states, “that only requires a user to view a malicious email within a vulnerable version of the webmail service.”

Once running, the custom malware — which the attackers call “Улей” or “Ulej” (Russian for “beehive”) — executes a 12‑stage automated collection workflow. It operates entirely over Zimbra’s own SOAP API, making its requests appear, at a protocol level, as normal user activity. The script first pings attacker‑controlled infrastructure to signal that a victim has been hooked. From there, it systematically gathers the victim’s email address, environment details, two‑factor authentication scratch codes, device status, OAuth consumers, and any passwords that a browser password manager might autofill into hidden form fields. It then tries to create an app‑specific password named “ZimbraWeb” and enables IMAP if it is not already on. Finally, it downloads every email from the past 90 days that is not marked as junk, packages them as compressed archives, and sends them on to the attackers.

Data at Risk: What Gets Stolen

The scope of data collection is alarming for any organization that uses self‑hosted Zimbra. The Ulej script exfiltrates:

  • 90 days of email – Collected day by day, excluding junk, and compressed before transfer.
  • Global Address List – The complete organization directory, enumerated by brute‑forcing two‑character search queries, giving attackers a roadmap of employees, roles, and naming conventions.
  • Authentication material – Two‑factor scratch codes, newly generated application passwords, and any credentials that autofill from the browser’s password manager.
  • Account and device metadata – Email address, Zimbra version, client type, device status, and OAuth consumer lists.

All of this is sent to Flowerbed, a container‑based collection framework running on short‑lived virtual private servers. Smaller payloads, such as email addresses and scratch codes, are exfiltrated over DNS using Base32‑encoded subdomains. Larger files — including the entire mailbox archive — go out over HTTPS with valid Let’s Encrypt certificates, making them indistinguishable from normal encrypted web traffic to many network sensors.

Why This Campaign Stands Out

LAUNDRY BEAR had previously relied on credential‑focused techniques: password spraying, adversary‑in‑the‑middle phishing with Evilginx, and bulk collection from cloud email services. The Zimbra campaign is a technical step up. By exploiting a client‑side vulnerability, the group can bypass multi‑factor authentication and user awareness training entirely because the victim is already logged in when the payload fires.

Several aspects make the operation particularly dangerous:

  • Zero‑day timeline – Active exploitation began in July 2025, months before a fix was available. Even after Synacor released patches in November 2025, many organizations remained vulnerable.
  • Internal distribution – Since at least November 2025, the attackers have increasingly used previously compromised Zimbra accounts to send malicious emails internally. Messages from a known colleague are far more likely to be opened.
  • Built‑in persistence – Creating an app‑specific password and enabling IMAP gives the attackers a durable back door, independent of the original browser session.
  • Operational playbook – The script tracks days already exfiltrated via localStorage keys like zd_comp_2025-12-01, so it can resume collection on subsequent executions without re‑sending old data.

Immediate Steps for Zimbra Administrators

The single most important action is patching. If your Zimbra version is older than 10.0.18 (for the 10.0 branch) or older than 10.1.13 (for the 10.1 branch), you are exposed. Apply the update now, even if it means bypassing a regular maintenance window.

If an immediate patch is impossible, switch users to an alternative mail client — such as a desktop application or the Zimbra Modern UI — and disable or severely restrict access to the Classic web interface. The vulnerability only affects that specific client.

After patching, perform these forensic and remediation steps:

  1. Hunt through mailbox logs – Search /opt/zimbra/log/mailbox.log for SOAP requests that match the attack pattern:
    • High‑volume SearchGalRequest commands from a single user (indicates GAL enumeration).
    • CreateAppSpecificPasswordRequest with an application name of “ZimbraWeb.”
    • GetScratchCodesRequest calls.
    • ModifyPrefsRequest enabling IMAP (zimbraPrefImapEnabled set to TRUE).
  2. Check endpoints for artifacts – On Windows machines that accessed Zimbra, examine browser localStorage for keys matching the pattern zd_comp_YYYY-MM-DD. Their presence flags which dates were likely exfiltrated.
  3. Revoke suspicious credentials – Immediately delete any app‑specific password named “ZimbraWeb.” Revoke all existing app‑passwords and two‑factor scratch codes for potentially affected users, then force password resets. Consider that any password stored in the browser’s password manager may also have been stolen.
  4. Disable unnecessary protocols – If IMAP is not required, disable it globally. Otherwise, review IMAP access logs for newly observed client activity.
  5. Examine network traffic – Look for large HTTPS POST requests to unfamiliar domains, especially shortly after a user opens an HTML‑rich email. DNS logs should be checked for high‑frequency queries to newly registered domains containing long, random subdomain labels.
  6. Quarantine and search for the original email – The initial malicious message may still reside in the victim’s inbox, sent folder, or other mailboxes. Search for HTML emails containing SVG elements, @import directives in CSS, or obfuscated JavaScript.

How We Got Here

The LAUNDRY BEAR group was first publicly identified in May 2025 by Dutch intelligence services and Microsoft, though its activity dates to at least April 2024. Early operations focused on high‑volume credential theft — buying stolen credentials, setting up fake login portals for European defense events, and using Evilginx to intercept session tokens for Microsoft 365 accounts.

The pivot to Zimbra in mid‑2025 shows an intentional move toward more technically sophisticated access methods. The Ulej capability and Flowerbed framework were custom‑built for this campaign, and while the code shows signs of AI‑assisted development, it is operationally effective. The attackers rotate their virtual‑private‑server infrastructure frequently — typically every 7 to 60 days — and use Mullvad VPN to mask their own connections, making static blocklists a short‑term stopgap at best.

The Bigger Picture for Enterprise Email Security

This campaign is a vivid reminder that email security cannot stop at spam filters and user‑awareness posters. Modern webmail clients are complex applications with rich scripting environments, and a single flaw in HTML sanitization can undermine the entire trust model. When an attacker can execute code in an authenticated browser session, multi‑factor authentication, conditional access policies, and strong passwords become irrelevant — the attack inherits all the user’s privileges.

For Windows‑oriented enterprises, the impact extends beyond the Linux server running Zimbra. Every Windows workstation with a browser that logged into webmail becomes a potential point of credential theft. Endpoint detection and response tools should be tuned to catch anomalous browser behavior — unexpected outbound connections, rapid DNS queries, and hidden credential fields injected into trusted pages.

Outlook

The patch for CVE‑2025-66376 closes the door on this specific attack vector, but it does not retire the threat group. LAUNDRY BEAR will almost certainly continue to target email platforms, adapting its techniques as defenses evolve. Organizations that treat this as a one‑off patching exercise and return to business as usual remain vulnerable to the next client‑side exploit. Continuous monitoring of mailbox API activity, strict credential hygiene, and a readiness plan for zero‑day email bugs are now basic requirements — not optional extras.