Answer Brief
Russian state-supported cyber actors (LAUNDRY BEAR) have exploited a zero-day XSS vulnerability (CVE-2025-66376) in Zimbra Collaboration Suite since July 2025 to exfiltrate 90 days of email, GAL, and authentication data via a view-only phishing technique, requiring only that victims open a malicious email in a vulnerable web client.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
Earliest assessed malicious cyber activity by LAUNDRY BEAR per May 2025 advisories from AIVD, MIVD, and Microsoft
- 2
LAUNDRY BEAR begins targeting Zimbra Collaboration Suite using zero-day exploit CVE-2025-66376
- 3
Patch for CVE-2025-66376 released for Zimbra Collaboration Suite versions 10.1.13 and 10.0.18
- 4
CVE-2025-66376 published in the National Vulnerability Database (NVD)
Executive Summary: Russian state-supported cyber actors (LAUNDRY BEAR) have exploited a zero-day XSS vulnerability (CVE-2025-66376) in Zimbra Collaboration Suite since July 2025 to exfiltrate 90 days of email, GAL, and authentication data via a view-only phishing technique, requiring only that victims open a malicious email in a vulnerable web client.
Why It Matters
The cybersecurity advisory from CISA and 13 international partner agencies details a sustained espionage campaign by the Russian state-supported APT group LAUNDRY BEAR targeting users of the Zimbra Collaboration Suite (ZCS) since at least July 2025. The group leverages a zero-day XSS vulnerability, CVE-2025-66376, which allows execution of arbitrary JavaScript when a user views a malicious email in a vulnerable Zimbra web client—requiring no clicks or file openings, only that the email be viewed. This view-based exploit represents a significant evolution in the group’s tactics, moving from earlier reliance on password spraying, phishing, and pass-the-cookie techniques to a more sophisticated, technically driven method of initial access. The vulnerability was patched by Synacor in November 2025, but the advisory notes that exploitation began months before the patch and CVE publication, confirming the initial use of a zero-day exploit. The exploit’s payload, delivered via a Base64-encoded XOR-encrypted script embedded in an SVG element’s onload attribute, executes in 12 asynchronous stages to gather and exfiltrate sensitive data. Notably, the script attempts to collect the victim’s last 90 days of email, the Global Address List (GAL), email address, passwords from password managers via autocomplete interception, 2FA scratch codes, and newly generated Application Passcodes. Data is exfiltrated through both DNS and HTTPS channels to actor-controlled infrastructure, with DNS using Base32 encoding over A record queries and HTTPS using JSON and octet-stream content types via Let’s Encrypt-secured endpoints. The exfiltration framework, dubbed 'Ulej', sends data to the 'Flowerbed' collection system—a Dockerized Python project using Nginx as a reverse proxy and Certbot for automated TLS certificates—highlighting the group’s use of automation and infrastructure-as-a-service tactics. Analysis of the Flowerbed framework indicates possible AI involvement in its development, suggesting a blend of novice-level software engineering with increasing reliance on AI-assisted coding to compensate for limited native development capabilities. The group demonstrates strong operational security (OPSEC) by using Mullvad VPN to anonymize traffic, procuring VPSs with fabricated identities, and rotating infrastructure every 7–60 days. Persistence mechanisms include modifying account preferences to enable IMAP and creating application-specific passwords, allowing long-term access even after credential resets. The advisory notes that LAUNDRY BEAR likely conducts manual victim selection through public-facing Zimbra fingerprinting via port scanning and commercial datasets, then compiles target email lists from OSINT, previously exfiltrated data, or vendor-provided lists. Targeting spans multiple sectors including the Defense Industrial Base, federal and local government, education, energy, law enforcement, media, NGOs, and technology organizations—consistent with espionage objectives rather than financial gain. The absence of ransomware or extortion, combined with the covert, persistent nature of the activity, supports the assessment that this is intelligence collection for the Russian Federation. The group’s history of targeting Ukrainian entities prior to NATO allies further suggests a phased approach: using Ukraine as a proving ground for TTPs before broader deployment. The advisory’s release by a broad coalition of agencies—including NSA, FBI, CISA, ACSC, ANSSI, NCSC-UK, and others—underscores the global concern over this campaign. Organizations are urged to patch immediately, monitor for IOCs such as known malicious domains (e.g., zmailanalytics.com, analyticemailmeter.com), and review ZCS mailbox logs for abnormal SOAP request patterns like repeated SearchGalRequest or CreateAppSpecificPasswordRequest calls. The use of localStorage to track exfiltrated email dates (zd_comp_YYYY-MM-DD) provides defenders with a forensic artifact to assess compromise scope. While patching CVE-2025-66376 mitigates this specific vector, the advisory warns that LAUNDRY BEAR will likely continue targeting ZCS and other email systems using novel vulnerabilities and social engineering, necessitating continuous vigilance in email security, authentication monitoring, and anomaly detection in webmail access patterns.
Event Type: security
Importance: high
Affected Companies
- Cloudflare
- Let's Encrypt
- Microsoft
- Mullvad VPN
- Palo Alto Networks Unit 42
- Proofpoint
- ProtonMail
- Seqrite
- Synacor
- Zimbra
Affected Sectors
- Cybersecurity
- Defense Industrial Base
- Education
- Email Services
- Energy
- Government
- Law Enforcement
- Media
- Non-Governmental Organizations
- Technology
Key Numbers
- Last 90 days of email exfiltrated per victim: 90 days
- CVE-2025-66376 patch release month: November 2025
- Initial exploitation of zero-day: July 2025
- CVE-2025-66376 publication date: 5 January 2026
- Advisory release date: 23 July 2026
- Number of authoring and co-sealing agencies: 14
Timeline
- Earliest assessed malicious cyber activity by LAUNDRY BEAR per May 2025 advisories from AIVD, MIVD, and Microsoft
- LAUNDRY BEAR begins targeting Zimbra Collaboration Suite using zero-day exploit CVE-2025-66376
- Patch for CVE-2025-66376 released for Zimbra Collaboration Suite versions 10.1.13 and 10.0.18
- CVE-2025-66376 published in the National Vulnerability Database (NVD)
- CISA releases Cybersecurity Advisory AA26-204A detailing ongoing LAUNDRY BEAR campaign targeting Zimbra users
Frequently Asked Questions
What is CVE-2025-66376 and how is it exploited by LAUNDRY BEAR?
CVE-2025-66376 is a cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite caused by improper neutralization of CSS @import directives. LAUNDRY BEAR exploits it by embedding a Base64-encoded, XOR-encrypted JavaScript payload in an SVG element within a malicious email; simply viewing the email in a vulnerable Zimbra web client triggers execution, enabling data exfiltration without user interaction beyond opening the email.
What data does the Ulej capability exfiltrate from compromised Zimbra accounts?
The Ulej capability exfiltrates the victim’s last 90 days of email, email address, password, Global Address List (GAL), two-factor authentication (2FA) tokens, newly created Application Passcodes, client type, Zimbra version, URL at time of exploitation, and device status via DNS and HTTPS channels to actor-controlled infrastructure.
How does LAUNDRY BEAR establish persistent access to compromised Zimbra accounts?
LAUNDRY BEAR establishes persistence by enabling IMAP access via the 'zimbraPrefImapEnabled' preference and generating Application Passcodes named 'ZimbraWeb' through SOAP requests, allowing continued access even if passwords are changed, particularly for clients that do not support native 2FA.
What mitigations does CISA recommend for organizations using Zimbra Collaboration Suite?
CISA recommends immediately patching CVE-2025-66376, using alternative mail clients if patching is not feasible, monitoring for suspicious outbound connections to VPS providers and DNS queries to suspicious domains, inspecting HTTPS traffic for exfiltration patterns, revoking Application Passcodes and 2FA tokens, resetting passwords, and searching for IOCs such as known malicious domains and email hashes.
Why is the targeting of Ukrainian organizations significant in the LAUNDRY BEAR campaign?
Extensive prior targeting of Ukrainian users suggests LAUNDRY BEAR uses Ukraine as a testbench to refine malicious techniques before deploying them against broader NATO and Western targets, indicating a strategic progression in their espionage operations.