Joint Advisory Warns of Persistent 'Laundry Bear' Espionage Campaign Exploiting Zero-Click Zimbra Vulnerabilities

Executive Summary\n\nIn a joint security advisory issued in late July 2026, CISA, the FBI, and international partners from over a dozen countries detailed an expansive cyber espionage campaign conducted by the Russian-linked threat actor known as "Laundry Bear" (also tracked as Void Blizzard). This campaign, which has been active since at least July 2025, specifically targets Western government agencies and commercial entities utilizing the Zimbra Collaboration Suite (ZCS). The primary objective appears to be the long-term collection of sensitive diplomatic and strategic email communications to support Kremlin decision-making during current geopolitical shifts.\n\n## Threat Analysis\n\nLaundry Bear has demonstrated exceptional technical proficiency by exploiting a zero-click vulnerability (CVE-2025-66376) within the Zimbra webmail service. Unlike traditional phishing, this attack requires no user interaction beyond the simple act of viewing a malicious email. The campaign has transitioned from targeting Ukrainian infrastructure to a broader scope encompassing NATO allies and U.S. commercial interests. Analysts assess that the lack of financial extortion confirms the operation's purely intelligence-driven mandate. The group's focus on enterprise-grade Linux mail environments suggests a highly specialized unit dedicated to compromising organizational communication hubs rather than individual workstations.\n\n## Technical Details\n\nThe heart of the campaign lies in the exploitation of CVE-2025-66376, a critical flaw in the ZCS webmail interface. Upon a user viewing the specially crafted email, the exploit triggers a custom-developed data exfiltration tool named "Ulej." Ulej is designed to perform bulk aggregation of account data, including the previous 90 days of email history, cleartext passwords, search history, and internal organizational directories. Notably, the tool is capable of capturing session tokens and two-factor authentication (2FA) codes in real-time, allowing the actor to maintain persistent access even after initial password resets. The infrastructure utilized for Command and Control (C2) involves a rotating array of compromised Linux-based servers primarily located in neutral jurisdictions to evade traditional IP-based blacklisting.\n\n## Attribution Assessment\n\nIntelligence agencies attribute this activity to Laundry Bear with high confidence. The group's tradecraft, specifically the use of the Ulej framework and the strategic prioritization of Ukrainian targets as a "testbench" before global deployment, mirrors known patterns associated with Russian military intelligence (GRU) sub-units. While some technical overlaps exist with APT28 (Fancy Bear), the specific modularity of the Ulej kit and the focus on zero-click server-side exploitation suggest a distinct, well-resourced operations team with a unique development pipeline for mail-specific implants.\n\n## Implications\n\nThe success of a zero-click exploit against a widely used enterprise collaboration suite presents a significant risk to diplomatic confidentiality. The exfiltration of internal directories and 2FA tokens suggests that Laundry Bear is not just seeking content, but is mapping organizational structures for downstream "living-off-the-land" (LotL) operations. The 90-day lookback window for email exfiltration allows the actor to reconstruct sensitive timelines of government decision-making processes, providing the Russian state with a persistent information advantage in ongoing international negotiations.\n\n## Recommendations\n\nOrganizations utilizing Zimbra Collaboration Suite should immediately update to the latest patched version (v10.2.1 or higher) to remediate CVE-2025-66376. Security teams are advised to monitor for unusual API calls originating from the webmail service, particularly those associated with bulk data exports. Implementation of hardware-based security keys (FIDO2) is strongly recommended to mitigate the risk of 2FA token theft. Finally, a thorough audit of all mail service accounts for unauthorized forwarding rules or newly created API keys should be conducted as part of the standard incident response protocol.