Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries

The Laundry Bear (Void Blizzard) threat group exploited a zero-day vulnerability in Zimbra Collaboration Suite that required no user interaction, enabling silent theft of emails, passwords, and 2FA tokens from government and commercial targets. The core failure lies in the window of exposure between vulnerability discovery and patching — organizations running unpatched Zimbra instances remained vulnerable even after a fix was released in November 2025. Zero-interaction exploits are particularly dangerous because traditional user awareness training provides no defence; the attack surface is the software itself. This incident underscores that internet-facing collaboration platforms are high-value targets for nation-state actors and must be subject to accelerated patching processes. Continued targeting of unpatched instances after a fix is available highlights that many organizations lack mature vulnerability management programs capable of rapidly remediating critical flaws.