[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwgjxrMPJGd6pzSq4-W2ANG7XhAjgSDLZumsGpYR9X1Y":3},{"article":4,"iocs":52},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":29,"category":30,"article_tags":34},"2452dba1-9053-48bd-9490-e2a0b4f80e1b","Russian hackers exploit Zimbra zero-click flaw for email theft","russian-hackers-exploit-zimbra-zero-click-flaw-for-email-theft-3735cd","CISA is warning that the Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is targeting organizations using Zimbra Collaboration email servers by combining phishing attacks with the exploitation of a now-patched Zimbra vulnerability. [...]","Russian state-sponsored hackers, identified as Laundry Bear or Void Blizzard, are exploiting a Zimbra Collaboration Suite vulnerability (CVE-2025-66376) to steal email data. This zero-click cross-site scripting flaw allows attackers to execute JavaScript in crafted HTML emails, enabling them to collect recent emails, credentials, and MFA tokens without user interaction. The group also uses AiTM phishing kits and has been observed exfiltrating data via DNS and HTTPS to their 'Flowerbed' framework.","Russian hackers exploit Zimbra zero-click flaw for email theft.","Russian hackers exploit Zimbra zero-click flaw for email theft By Lawrence Abrams July 23, 2026 12:49 PM 0 CISA is warning that the Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is targeting organizations using Zimbra Collaboration email servers by combining phishing attacks with the exploitation of a now-patched Zimbra vulnerability. According to CISA, Laundry Bear has targeted and compromised users in organizations associated with the Defense Industrial Base (DIB), federal and local government, education, energy, law enforcement, media, non-governmental organizations, and technology. The attackers exploit the Zimbra CVE-2025-66376 flaw, a cross-site scripting (XSS) vulnerability affecting Zimbra Collaboration Suite's Classic UI. The flaw allows JavaScript embedded in specially crafted HTML emails to execute automatically when a victim views the message, enabling attackers to steal account data without requiring the user to click a link or visit a phishing site. According to CISA, Laundry Bear exploited the flaw as a zero-day before Zimbra patched it in November 2025 and continues to target organizations running unpatched servers. The vulnerability was later tagged by CISA as actively exploited in attacks. CISA says Laundry Bear's exploit is used to automatically collect and send the victim's last 90 days of emails, email address, password, Global Address List (GAL), and two-factor authentication (2FA) tokens. The attackers also create and send back a new Zimbra application passcode, which is used by legacy email clients like IMAP or ActiveSync that do not support the TOTP authentication flows. Using a passcode allows the attackers to retain access to the email account while bypassing MFA. According to CISA, the malware exfiltrates stolen information over both DNS and HTTPS to an actor-controlled server running the group's \"Flowerbed\" collection framework. Smaller data is encoded and transmitted in DNS A-record queries, while larger payloads, including mailbox data, are uploaded over HTTPS as compressed archives to the attacker-controlled servers. In addition to exploiting the Zimbra flaw, Laundry Bear also utilizes adversary-in-the-middle (AiTM) phishing kits designed to impersonate legitimate Zimbra login portals, stealing credentials and session cookies, allowing the attackers to gain access to targets' email accounts. CISA released IOCs that show the campaign used sites that impersonate Zimbra infrastructure, using domain names like 'mailnalysis.com', 'emailanalytics.com.ua', 'zimbrastat.com', 'zimbra-metadata.com', 'istc-cloud.com', and 'zmailanalytics.com'. The advisory recommends that organizations using Zimbra: Update to the latest version of the software to install all available security updates. Review the published indicators of compromise. Investigate systems for connections to the identified domains and IP addresses. Monitor for suspicious authentication activity. Revoke any unauthorized application passcodes, especially those with the 'ZimbraWeb'. Review accounts for unauthorized mailbox access. CISA also recommends implementing phishing-resistant multi-factor authentication where possible. Laundry Bear targeted governments, police, and Ukraine The Laundry Bear hacking group was first attributed to cyberespionage attacks in May 2025 by the Dutch intelligence agencies. The Dutch agencies publicly attributed the group to a 2024 compromise of the Dutch National Police that exposed the personal information of police personnel and led to the identification of a previously unknown Russian espionage group. Microsoft tracks the same group under the name Void Blizzard. Since at least 2024, the group has focused on intelligence collection against organizations aligned with Russian strategic interests, primarily targeting NATO member states and Ukraine. Microsoft has also documented successful compromises of organizations supporting Ukraine, including entities in the defense, transportation, and aviation sectors. Earlier this year, BleepingComputer reported on a separate Laundry Bear campaign targeting Ukraine's military using charity-themed phishing emails to deliver malware disguised as donation requests. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: Google: Hackers exploited Zimbra zero-day in attacks on govt orgsUkraine's army targeted in new charity-themed malware campaignCheck Point warns of SmartConsole zero-day exploited in attacksMicrosoft working to fix Exchange Online mailbox quarantine issueSouth Korea discloses data breach impacting diplomats worldwide","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Frussian-hackers-exploit-zimbra-zero-click-flaw-for-email-theft\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2021\u002F04\u002F16\u002Fmalware-phishing-header.jpg","2026-07-23T16:49:27+00:00","2026-07-23T18:00:24.685436+00:00",9,[18,21,23,26],{"name":19,"type":20},"Laundry Bear","threat_actor",{"name":22,"type":20},"Void Blizzard",{"name":24,"type":25},"Zimbra Collaboration Suite","product",{"name":27,"type":28},"Flowerbed","campaign","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":29,"icon":31,"name":32,"slug":33},null,"Nation-state","nation-state",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57,61,63,65,67,69],{"type":54,"value":55,"context":56},"cve","CVE-2025-66376","Zimbra Collaboration Suite XSS vulnerability exploited by Laundry Bear.",{"type":58,"value":59,"context":60},"domain","mailnalysis.com","Malicious domain used by Laundry Bear for C2 communication.",{"type":58,"value":62,"context":60},"emailanalytics.com.ua",{"type":58,"value":64,"context":60},"zimbrastat.com",{"type":58,"value":66,"context":60},"zimbra-metadata.com",{"type":58,"value":68,"context":60},"istc-cloud.com",{"type":58,"value":70,"context":60},"zmailanalytics.com"]