US Agencies Warn of Laundry Bear Campaign Targeting Unpatched Zimbra Servers

US agencies warn Russian group Laundry Bear is exploiting a patched Zimbra flaw to steal email accounts from organizations running unpatched servers.

The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI) and other U.S. government and international partners published a joint advisory to warn that the Russia-linked APT group Laundry Bear (aka Void Blizzard) is targeting organizations using unpatched Zimbra Collaboration servers.

The attackers exploit CVE-2025-66376, an XSS flaw that allows malicious JavaScript embedded in HTML emails to run automatically when viewed, enabling account theft without user interaction. The vulnerability was exploited as a zero-day before being patched and remains under active exploitation against unpatched systems.

“Unlike traditional phishing that attempts to persuade a user to take an action, such as clicking a link or downloading a file, LAUNDRY BEAR’s current campaign uses a zero-click exploit that only requires a user to view a malicious email within a vulnerable version of the ZCS webmail service.” reads the advisory. “This campaign uses a custom-developed aggregation and data exfiltration capability called Ulej to exploit a common vulnerabilities and exposures (CVE) in ZCS, CVE-2025-66376, with the potential for adaption to exploit other vulnerabilities as well. This advisory provides several mitigations to protect against this activity and specific remediation actions for organizations that detect indicators of compromise in their environment. “

LAUNDRY BEAR conducted a sophisticated campaign targeting Zimbra Collaboration Suite (ZCS) users by exploiting CVE-2025-66376, a zero-day vulnerability that enabled JavaScript execution directly from malicious emails.

“To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [T1566].” continues the advisory. “Through exploitation of CVE-2025-66376, this JavaScript payload is immediately executed once the user views the malicious email [T1203], such as the one shown in Figure 1, in the ZCS webmail platform.”

The group began exploiting the flaw before public disclosure and patch availability, demonstrating the ability of emerging threat actors to weaponize unknown vulnerabilities.

The attack starts with phishing emails sent from previously compromised accounts to evade detection and increase credibility. When victims open the message in Zimbra webmail, the embedded JavaScript executes through abused CSS @import directives.

“Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [T1027.017], as shown in Figure 3. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage CVE-2025-66376.” continues the advisory. “This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see Figure 3) [T1027.013].”

The payload uses encryption and obfuscation techniques to bypass basic security controls and launches a multi-stage script designed for reconnaissance, credential theft, and data collection.

The malware attempts to maintain access by enabling IMAP, creating application passwords, harvesting two-factor authentication codes, and extracting saved browser password manager credentials. It collects mailbox information, user environment details, contacts, OAuth consumers, device status, and emails from the previous 90 days.

“LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the enable_mail_protocols stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent.” states the advisory. “This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.”

Collected data is exfiltrated through HTTPS and DNS channels to attacker-controlled infrastructure named Flowerbed, using a dedicated service called Catcher to receive and temporarily store stolen information. The campaign highlights the growing capability of smaller threat groups to exploit zero-days, bypass MFA protections, and compromise enterprise email environments for intelligence gathering and further attacks.

CISA released indicators of compromise (IOCs) linked to the LAUNDRY BEAR campaign, revealing that attackers used websites designed to impersonate legitimate Zimbra infrastructure. The threat actors registered deceptive domains, including mailnalysis.com, emailanalytics.com.ua, zimbrastat.com, zimbra-metadata.com, istc-cloud.com, and zmailanalytics.com, to support their operations and potentially collect stolen information.

To mitigate the risk, CISA recommends that organizations running Zimbra update their deployments to the latest available versions, review the published IOCs, and investigate possible connections to the identified domains and IP addresses. Organizations should also monitor authentication activity for anomalies, revoke unauthorized application passcodes, particularly those created with the “ZimbraWeb” identifier, and check user accounts for unauthorized mailbox access. In addition, CISA advises implementing phishing-resistant multi-factor authentication to reduce the risk of account compromise and limit the impact of similar campaigns.

In May, Netherlands General Intelligence and Security Service (AIVD) and the Netherlands Defence Intelligence and Security Service (MIVD) linked a previously undetected Russia-linked group, tracked Laundry Bear (aka Void Blizzard), to a 2024 police breach. In October 2024, the Dutch police blamed a state actor for the recent data breach that exposed officers’ contact details, the justice minister told lawmakers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Zimbra)