Russian "Laundry Bear" APT Deploys "Beehive" Zero-Click Exploit Against Western Diplomatic Targets

Executive Summary

On July 24, 2026, a coalition of international cybersecurity agencies, including the NCSC and CISA, issued a critical advisory regarding a widespread espionage campaign conducted by the Russian-linked threat actor Laundry Bear (also known as Void Blizzard and UAC-0190). The operation leverages a sophisticated zero-click exploit named "Beehive" (or "Ulej") to compromise the Zimbra Collaboration Suite (ZCS). Unlike traditional phishing, this attack requires no user interaction beyond the receipt of a malicious email. Targeted entities include government ministries, defense contractors, and NGOs across Western Europe, North America, and the Indo-Pacific.

Threat Analysis

Laundry Bear has demonstrated a significant evolution in its tradecraft over the last 24 months. While previous operations relied on Adversary-in-the-Middle (AiTM) techniques using tools like Evilginx to harvest session tokens, the current "Silent Swarm" campaign utilizes an automated, server-side exploit. This shift indicates a high degree of technical investment and a preference for mass-scale, persistent access over surgical social engineering. The actor appears to be prioritizing the exfiltration of high-value diplomatic correspondence and strategic policy drafts, suggesting a direct mandate from Russian intelligence services to monitor Western responses to ongoing regional conflicts. The group's ability to automate the exploitation phase marks a dangerous escalation in their ability to conduct rapid intelligence gathering across multiple sectors simultaneously.

Technical Details

The core of the campaign is the "Beehive" exploit, which targets a critical vulnerability in the Zimbra Collaboration Suite (CVE-2025-66376). This vulnerability allows for remote code execution (RCE) via a malformed MIME-encoded attachment that triggers when the ZCS indexing service processes the email. Once the "Ulej" payload is deployed, it executes in-memory to avoid detection by traditional disk-based EDR solutions. The malware is designed to harvest the Global Address List (GAL), session cookies, and the last 90 days of email communications. Exfiltration is conducted via HTTPS POST requests to a rotating network of compromised legitimate websites, masking the malicious traffic within standard web activity. The payload also attempts to establish secondary persistence by creating hidden application passcodes for compromised accounts.

Attribution Assessment

With high confidence, the NCSC and its partners attribute this activity to Laundry Bear, an actor operating on behalf of the Russian Federation. This assessment is based on the overlapping infrastructure used in previous campaigns targeting the Ukrainian Ministry of Defense and the use of the specific "Ulej" codebase, which contains comments and metadata in the Russian language. The group’s tactics align with the GRU’s strategic objectives of destabilizing NATO alliances and gathering intelligence on Western military logistics. The campaign was observed being "test-benched" against Ukrainian targets in early 2025 before being scaled for global deployment against G7 members.

Implications

The success of the Beehive exploit represents a major setback for diplomatic security. The ability to exfiltrate entire mailboxes without any user interaction allows Laundry Bear to maintain long-term, invisible persistence within critical networks. For governments, the loss of diplomatic cables could jeopardize international negotiations and reveal sensitive positioning on trade and security. For the private sector, specifically defense and energy, the compromise of internal communications could lead to the theft of intellectual property and the exposure of supply chain vulnerabilities. Furthermore, the use of automated zero-click exploits reduces the window for defenders to respond before data exfiltration occurs.

Recommendations

Organizations utilizing Zimbra Collaboration Suite must immediately apply the latest security patches and verify the integrity of their ZCS installations. Critical steps include: 1. Auditing all ZCS logs for connections to known-malicious hosting providers or unusual outbound traffic on port 443. 2. Rotating all session tokens and administrative passwords for users in sensitive departments. 3. Implementing hardware-based MFA (FIDO2) to mitigate the impact of token theft. 4. Employing network-level visibility tools to detect anomalous data spikes on outbound HTTPS traffic. 5. Restricting ZCS webmail access to known IP ranges via VPN where possible to reduce the internet-facing attack surface.