US government agencies have issued a joint advisory warning that the Russian APT group Laundry Bear is actively exploiting a patched Zimbra zero-day vulnerability to compromise email accounts. The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), and international partners confirmed that the Russia-linked threat actor, also known as Void Blizzard, is targeting organizations running unpatched Zimbra Collaboration servers through exploitation of CVE-2025-66376.
How Does the Zimbra Zero-Day Attack Work?
The vulnerability CVE-2025-66376 is a cross-site scripting (XSS) flaw that enables malicious JavaScript embedded in HTML emails to execute automatically when a user simply views the message. This zero-click exploit requires no user interaction beyond opening the email in the Zimbra webmail service, distinguishing it from traditional phishing attacks that depend on victims clicking links or downloading files.
Laundry Bear begins the attack by sending phishing emails from previously compromised accounts to evade detection and appear more credible. When victims open these messages in Zimbra webmail, embedded JavaScript executes through abused CSS @import directives. The payload is concealed within a Base64 encoded payload inside the onload field of a Scalable Vector Graphics (SVG) element, using XOR encryption to bypass basic security controls.
What Data Does the Malware Steal?
Once executed, the multi-stage script performs reconnaissance, credential theft, and extensive data collection. The malware maintains persistent access by enabling IMAP, creating application passwords, harvesting two-factor authentication codes, and extracting saved browser password manager credentials. During the enable_mail_protocols stage, the malware sends a SOAP request using the ModifyPrefsRequest command to set the zimbraPrefImapEnabled preference to TRUE, ensuring IMAP access to victim mailboxes remains enabled.
The custom-developed data exfiltration capability called Ulej collects mailbox information, user environment details, contacts, OAuth consumers, device status, and emails from the previous 90 days. Stolen data is exfiltrated through HTTPS and DNS channels to attacker-controlled infrastructure named Flowerbed, using a dedicated service called Catcher to receive and temporarily store the information.
What Infrastructure Supports This Campaign?
CISA released indicators of compromise revealing that attackers used websites designed to impersonate legitimate Zimbra infrastructure. The threat actors registered deceptive domains including mailnalysis.com, emailanalytics.com.ua, zimbrastat.com, zimbra-metadata.com, istc-cloud.com, and zmailanalytics.com to support operations and collect stolen information.
How Can Organizations Protect Themselves?
CISA recommends that organizations running Zimbra update deployments to the latest available versions immediately. Additional protective measures include reviewing published IOCs, investigating possible connections to identified domains and IP addresses, monitoring authentication activity for anomalies, and revoking unauthorized application passcodes, particularly those created with the ZimbraWeb identifier. Organizations should also check user accounts for unauthorized mailbox access and implement phishing-resistant multi-factor authentication to reduce compromise risk.
In May, the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) linked Laundry Bear to a 2024 police breach that exposed officers’ contact details.
Source: Security Affairs