Joint Advisory Warns of 'Laundry Bear' Zero-Click Campaign Targeting Western Diplomatic Channels

Executive Summary

On July 23, 2026, a joint cybersecurity advisory (CSA) was issued by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the NSA, and the Netherlands’ General Intelligence and Security Service (AIVD) regarding an ongoing espionage campaign. The campaign is attributed to the Russian state-sponsored group known as Laundry Bear (also tracked as Void Blizzard). Since at least July 2025, this actor has been observed exploiting a critical zero-click vulnerability in the Zimbra Collaboration Suite (ZCS) to infiltrate government and commercial organizations across North America and Europe. The operation focuses on the covert acquisition of sensitive diplomatic and military intelligence, including email data and authentication credentials.

Threat Analysis

Laundry Bear has historically relied on credential-harvesting techniques such as password spraying and phishing. However, this latest campaign represents a significant escalation in technical capability. By leveraging a zero-click vector, the group can compromise accounts without requiring the user to click a link or open an attachment; simply viewing a malicious email is sufficient for exploitation.

The targeting has been highly surgical, focusing on organizations with public-facing infrastructure. Recent reports from Italian authorities indicate that the group specifically targeted the Interforce Cyber Training Center in Chiavari, seeking information on NATO naval exercises, maritime drone technologies, and air-defense systems. The absence of financial extortion confirms that the primary objective is long-term strategic espionage.

Technical Details

The core of the attack involves CVE-2025-66376, a cross-site scripting (XSS) vulnerability related to improper sanitization of Cascading Style Sheet (CSS) @import directives within the Zimbra webmail interface.

1. Injection: The attacker sends a specially crafted email containing a malicious CSS payload.
2. Execution: When the victim views the email, the ZCS web client executes a JavaScript payload that interacts with the user’s session.
3. Exfiltration: The script automatically exfiltrates the last 90 days of the victim's email communications, the Global Address List (GAL), and two-factor authentication (2FA) tokens to a remote command-and-control (C2) server.
4. Persistence: In many cases, the group attempted to use stolen session cookies to maintain persistent access even after password changes, leveraging "pass-the-cookie" techniques.

Attribution Assessment

Intelligence agencies attribute this activity with high confidence to the Russian Federation's military intelligence service (GRU). The group, referred to as Laundry Bear by the Dutch AIVD, overlaps significantly with tactics, techniques, and procedures (TTPs) associated with APT28. Technical indicators, including the specific infrastructure used for C2 and the modular nature of the JavaScript loaders, align with previous GRU-linked operations targeting Western diplomatic entities and military contractors.

Implications

The compromise of ZCS instances represents a critical breach of diplomatic security. The ability to exfiltrate email directories and 2FA tokens allows the actor to map out internal government hierarchies and potentially move laterally into more secure systems. Furthermore, the focus on military training facilities in Italy suggests an intent to gain a tactical advantage in the Mediterranean and broader NATO theater. The use of a zero-click exploit indicates that standard user-awareness training is insufficient to prevent these specific intrusions.

Recommendations

Encrygma recommends the following immediate actions for all entities utilizing Zimbra Collaboration Suite:

• Immediate Patching: Ensure all ZCS instances are updated to the latest version to mitigate CVE-2025-66376.
• Session Management: Implement short-lived session tokens and enforce re-authentication for sensitive actions.
• Network Segmentation: Isolate webmail servers from internal networks to prevent lateral movement following a compromise.
• Audit Logs: Review access logs for unusual patterns in email exfiltration or unauthorized access to the Global Address List.
• MFA Hardening: Move toward hardware-based security keys (e.g., FIDO2) which are more resilient against the session-theft techniques used in this campaign.