Russian Espionage Group Leverages Zimbra Zero-Day Exploit to Intercept Sensitive Communications and Authentication Codes from Western Targets

Key Findings

• Russian state-sponsored group Laundry Bear (also known as Void Blizzard) exploited a zero-day vulnerability in Zimbra Collaboration Suite for five months before patch in November 2025
• CVE-2025-66376 requires only viewing a malicious email to trigger exploit—no user interaction needed beyond opening the message
• Single exploit steals 90 days of email history, account passwords, 2FA tokens, organization email directory, and search history
• Targets span government, defense, energy, finance, transportation, technology and education sectors across NATO countries, Ukraine, and Africa
• Group remains actively exploiting unpatched Zimbra instances despite November 2025 patch availability
• 16 countries including US, UK, Australia and NATO allies issued joint cybersecurity advisory on July 23, 2026

Background

Laundry Bear has operated as a Russian state-sponsored threat group since at least 2024, conducting espionage campaigns with no financial extortion motives. The group first targeted Ukrainian organizations before expanding to Western governments and commercial entities, suggesting Ukraine serves as both a priority target and testing ground for new techniques. The advisory noted this pattern of Ukrainian targeting followed by NATO expansion represents an increasing trend among Russian cyber threat groups.

The Vulnerability and Exploit Mechanism

CVE-2025-66376 is a stored cross-site scripting flaw in Zimbra Collaboration Suite's Classic UI affecting versions 10.0 before 10.0.18 and 10.1 before 10.1.13. The vulnerability exploits how the email client handles CSS @import directives in HTML emails. Attackers craft malicious emails using tag-splitting techniques that hide executable code within fake @import statements and HTML comments, bypassing Zimbra's sanitizer. When the email renders, the fragments rejoin into functional JavaScript that executes within the user's authenticated webmail session.

The payload, tracked as ZimReaper, steals credentials and sensitive data through multiple vectors. It extracts the browser's autofilled password and CSRF tokens, accesses 2FA scratch codes through Zimbra's APIs, and brute-forces the Global Address List by querying every two-character combination. The stolen data gets exfiltrated via DNS queries to attacker infrastructure, with email archives compressed and sent to command-and-control servers.

Targeting and Campaign Details

Laundry Bear identifies targets by scanning for organizations with publicly-facing Zimbra infrastructure, then compiles email address lists for phishing campaigns. Exploit messages came from both attacker-controlled Proton Mail accounts and previously compromised email addresses, often disguised as news digests or routine communications.

At least nine command-and-control IP addresses and nine domains were used, with each server remaining active for an average of 35 days. Unit 42 researchers identified targeting across NATO member states, Ukraine, Commonwealth of Independent States nations, and African countries. Proofpoint confirmed US government, scientific, and defense industrial base entities were also targeted, including nuclear installations.

Post-Exploitation Persistence

After stealing credentials, attackers created app-specific passwords named ZimbraWeb through legitimate Zimbra API requests. These application passwords grant IMAP, POP3, or SMTP access while bypassing two-factor authentication requirements and survive standard password resets. Researchers documented cases where the payload also enabled IMAP access by modifying user preferences, allowing continued access even after victims reset compromised passwords.

Severity and Patching Challenges

The vulnerability received a CVSS score of 6.1 from NVD, classified as medium severity, highlighting how severity ratings alone can mislead defenders prioritizing patch schedules. Despite this moderate rating, the exploit's zero-click nature and access to sensitive authentication tokens made it particularly dangerous. Zimbra 10.0 reached end-of-life on December 31, 2025, making 10.0.18 critical for legacy deployments. Current releases include 10.1.20, which addresses four additional stored XSS vulnerabilities in the Classic Web Client discovered after the initial patch.

Remediation Requirements

Organizations must upgrade Zimbra 10.0 instances to at least 10.0.18 and move all 10.0 deployments to supported 10.1 builds, ideally 10.1.20 or later. However, patching alone is insufficient. Any mailbox that opened or previewed matching messages in vulnerable Classic UI sessions must be treated as compromised: passwords require reset, active sessions invalidation, and 2FA scratch codes regeneration. Messages that landed but were never opened should be examined for the fragmented @import pattern, which Proofpoint published YARA rules can detect.

Sources

• https://cyberscoop.com/russian-laundry-bear-zimbra-exploit/
• https://thehackernews.com/2026/07/russian-espionage-group-exploited.html