cyber.hendryadrian.com
Threat Research · cyber.gov.au

LAUNDRY BEAR Exploits Zimbra Flaw to Steal Emails and Credentials

· Original article ↗

Summary

A joint advisory says Russian state-supported LAUNDRY BEAR has exploited CVE-2025-66376 in Zimbra webmail since 2025, using the Ulej payload and Flowerbed infrastructure to collect emails and account data.

Key points

  • The agencies say the campaign has targeted government and commercial organizations since at least July 2025, initially exploiting CVE-2025-66376 as a zero-day.
  • Viewing a malicious email in vulnerable Zimbra webmail executes JavaScript through improperly sanitized CSS @import directives; the payload is hidden in an SVG element.
  • Ulej attempts to collect 90 days of emails, the global address list, saved passwords and two-factor authentication scratch codes.
  • The payload attempts to enable IMAP and create an application passcode named ZimbraWeb for persistent mailbox access.
  • The Flowerbed framework receives collected data over DNS and HTTPS, using a containerized Catcher service and an Nginx reverse proxy.
  • The agencies recommend updating Zimbra to patched versions, monitoring suspicious SOAP requests and outbound traffic, and revoking application passcodes and scratch keys after identifying campaign activity.

Article Details

Attack Vectors
  • Malicious emails exploit CVE-2025-66376 when viewed in vulnerable Zimbra webmail, executing JavaScript without a link click or attachment opening.
  • The payload uses the victim’s authenticated browser session to collect emails, account information and credentials, and attempts to create an application passcode and enable IMAP.
  • Collected data is sent to actor-controlled Flowerbed infrastructure over DNS and HTTPS.
  • Earlier activity used a fraudulent registration portal and Evilginx to intercept credentials and session tokens.
Defensive Notes
  • Apply the CVE-2025-66376 patches for ZCS 10.1.13 or 10.0.18; if immediate patching is not feasible, use alternative mail clients and avoid the Classic ZCS webmail client.
  • Enable MFA where possible and consider passkey-capable third-party authentication, while monitoring application passcodes.
  • Monitor outbound traffic to unfamiliar VPS infrastructure, unusual DNS subdomains, recently established domains and suspicious VPN connections.
  • Inspect ZCS logs for unusual SearchGalRequest, CreateAppSpecificPasswordRequest and GetScratchCodesRequest activity; check browser localStorage for zd_comp_YYYY-MM-DD entries and application passcodes named ZimbraWeb.
  • If compromise is identified, quarantine related malicious emails, revoke application passcodes and 2FA scratch keys, and require password changes.

Indicators of compromise

TypeIndicatorContext
DOMAINanalyticemailmeter[.]comDomain attributed to Flowerbed exfiltration infrastructure; potentially historical.
DOMAINemailanalytics[.]com[.]uaDomain attributed to Flowerbed exfiltration infrastructure; potentially historical.
DOMAINistc-cloud[.]comDomain attributed to Flowerbed exfiltration infrastructure; potentially historical.
DOMAINmailnalysis[.]comDomain attributed to Flowerbed exfiltration infrastructure; potentially historical.
DOMAINsynacorzimbra[.]nlDomain attributed to Flowerbed exfiltration infrastructure; potentially historical.
DOMAINzimbra-metadata[.]comDomain attributed to Flowerbed exfiltration infrastructure; potentially historical.
DOMAINzimbrasoft[.]com[.]uaDomain attributed to Flowerbed exfiltration infrastructure; potentially historical.
DOMAINzimbrastat[.]comDomain attributed to Flowerbed exfiltration infrastructure; potentially historical.
DOMAINzmailanalytics[.]comDomain attributed to Flowerbed exfiltration infrastructure; potentially historical.
EMAILc[.]laurent[.]ejfa@proton[.]meAddress identified as distributing campaign payloads.
EMAILgarrysmithme@pinmx[.]netAddress reportedly used to procure campaign infrastructure.
EMAILhostingclient@pinmx[.]netAddress reportedly used to procure campaign infrastructure.
EMAILivanka[.]zurabishvili@proton[.]meAddress reportedly used to procure campaign infrastructure.
EMAILj[.]moreau[.]epsc@proton[.]meAddress identified as distributing campaign payloads.
EMAILliberty[.]insights@proton[.]meAddress identified as distributing campaign payloads.
EMAILzmul1@buildandconsulting[.]comAddress reportedly used to procure campaign infrastructure.
IPV4104[.]248[.]134[.]194IP attributed to Flowerbed infrastructure; potentially historical.
IPV4185[.]86[.]79[.]95IP attributed to Flowerbed infrastructure; potentially historical.
IPV4193[.]238[.]152[.]66IP attributed to Flowerbed infrastructure; potentially historical.
IPV4194[.]156[.]103[.]193IP attributed to Flowerbed infrastructure; potentially historical.
IPV4216[.]252[.]238[.]104IP attributed to Flowerbed infrastructure; potentially historical.
IPV4216[.]252[.]238[.]18IP attributed to Flowerbed infrastructure; potentially historical.
IPV4216[.]252[.]238[.]64IP attributed to Flowerbed infrastructure; potentially historical.
IPV437[.]120[.]247[.]228IP attributed to Flowerbed infrastructure; potentially historical.
IPV464[.]226[.]124[.]190IP attributed to Flowerbed infrastructure; potentially historical.
SHA2561517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760Hash of an email sample containing the campaign’s malicious payload.
SHA25660db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874Hash of an email sample containing the campaign’s malicious payload.
SHA25698df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aafHash of an email sample containing the campaign’s malicious payload.
SHA256b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1dHash of an email sample containing the campaign’s malicious payload.

MITRE ATT&CK

T1027.010 · Command ObfuscationThe actors vary encryption keys and add nonfunctional import directives to evade basic signatures.T1027.013 · Encrypted/Encoded FileThe outer payload decodes and XOR-decrypts an encoded inner collection script.T1027.017 · SVG SmugglingThe email hides a Base64 payload in the onload attribute of an SVG element.T1048.002 · Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolUlej sends collected account information and email to Flowerbed over HTTPS.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolUlej sends encoded account data through DNS queries to Flowerbed infrastructure.T1087 · Account DiscoveryThe script queries the organization’s Global Address List and identifies the victim’s email address.T1098 · Account ManipulationThe payload attempts to enable IMAP and create an application passcode for sustained account access.T1114.002 · Remote Email CollectionThe script requests up to 90 days of email from the victim’s ZCS account.T1119 · Automated CollectionThe payload automatically collects account information and email in asynchronous stages.T1185 · Browser Session HijackingThe script uses the victim’s authenticated webmail session and CSRF token to make SOAP requests.T1203 · Exploitation for Client ExecutionViewing the email triggers a Zimbra cross-site scripting vulnerability and executes the payload.T1550.004 · Web Session CookieEarlier campaigns replayed stolen session tokens to access compromised accounts.T1556.006 · Multi-Factor AuthenticationThe script creates an application passcode usable by mail clients that do not support normal 2FA.T1557 · Adversary-in-the-MiddleEarlier activity used a fraudulent portal and modified Evilginx to intercept credentials and session tokens.T1566 · PhishingLAUNDRY BEAR sends emails containing a malicious JavaScript payload to targeted users.

CVE

CVE-2025-66376continues to be successfully exploited. The vulnerability, Common Vulnerabilities and Exposures (CVE) CVE-2025-66376, was patched in November 2025. This demonstrates LAUNDRY BEAR’s intent and ability to deploy

Threat Actors

Laundry BearThe advisory attributes the Zimbra phishing and exfiltration campaign to this Russian state-supported group. Microsoft tracks the actors as Void Blizzard, although the advisory cautions that industry groupings may not map one-to-one.TA488Microsoft’s name for the Russian state-supported actors described as LAUNDRY BEAR; the advisory cautions that industry groupings may not map one-to-one.

Malware

Ulejdeliver them to the Russian Federation. Using a custom-developed capability [T1587.001] named “Улей” or “Ulej” (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from

Vendors

Synacorwithin an email [5]. Because the activity attributed to this campaign began in July 2025—months before Synacor released a patch and the CVE was published—the payload initially exploited a zero-day vulnerability at

Products

Microsoft Exchangeadvisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [T1114.002]. TheZimbra Collaboration SuiteRussian state-sponsored cyber actors are conducting phishing campaigns targeting users of Zimbra Collaboration Suite. These campaigns aim to steal credentials and gain unauthorised access to email accounts and

Tools

Evilginxthis malicious site, LAUNDRY BEAR’s modified version of the open source adversary emulation toolkit, Evilginx, intercepted the user’s credentials. LAUNDRY BEAR then used this authentication data, includingEvilginx2capability, such as Flowerbed, alongside a previous reliance on open source capabilities, such as Evilginx2 [T1588.002], likely indicates a lack of advanced technical knowledge within LAUNDRY BEAR, especially inFlowerbedin an actor-controlled unattributable virtual private server (VPS) [T1074.002] running LAUNDRY BEAR’s “Flowerbed” collection framework. The collected data is almost certainly further exfiltrated to internal network

Countries

RussiaLAUNDRY BEAR’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data. Previous campaigns indicated LAUNDRYUkrainehttps://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit - Seqrite. Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. 2026.United States- United States National Security Agency (NSA)

Industries

Defense industrial base- the Defense Industrial Base (DIB),GovernmentA group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025.MediaMedia Inquiries / Press Desk: NSA Media Relations: 443-634-0721, [email protected] - Cybersecurity and Infrastructure Security Agency (CISA)Non-governmental organizations- non-governmental organizations, and

Related Articles