Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets

Summary

A Russian state-sponsored threat group, identified as 'Laundry Bear,' is actively exploiting a zero-day vulnerability in Zimbra collaboration software. The attackers are using a sophisticated 'half-click' phishing technique, where simply opening or previewing a specially crafted email can trigger the exploit. This campaign primarily targets organizations in the United States and Ukraine.

Indicators of Compromise

• malware — half-click

Entities