UK and Partners Expose Russian-Backed Zero-Click Email Campaign Targeting Western Organisations

Summary

The UK and 15 partner agencies say Russian-backed group LAUNDRY BEAR used a zero-click exploit against vulnerable Zimbra email systems to steal sensitive messages, and urge organisations to patch and improve monitoring.

Key points

The campaign has targeted organisations using Zimbra Collaboration Suite since July 2025, stealing sensitive email information.
The reported “beehive” technique compromises a user when they view a malicious email in a vulnerable Zimbra webmail service; no click or attachment opening is required.
The agencies attribute the activity to LAUNDRY BEAR and assess it as espionage almost certainly conducted with Russian state support.
US victims were reported across defence, government, education, energy, law enforcement, media, NGOs and technology; the methods were reportedly tested on Ukrainian victims before targeting NATO members.
Organisations using Zimbra are urged to patch immediately and improve network monitoring; UK organisations are also encouraged to join the NCSC Early Warning service.
The joint advisory is available at hxxps://media[.]defense[.]gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA[.]PDF.

Article Details

Event Type: Joint public advisory exposing a Russian state-supported cyber-espionage campaign using a zero-click email exploit against organizations using Zimbra Collaboration Suite.
Impact: Since July 2025, LAUNDRY BEAR has successfully stolen sensitive email information from targeted organizations. Viewing a malicious email in a vulnerable version of Zimbra Collaboration Suite can compromise a user without further interaction, enabling extensive and sustained email access. The campaign targeted US organizations in defence, government, education, energy, law enforcement, media, NGOs, and technology; the techniques were also tested on victims in Ukraine before being used against NATO members.