cyber.hendryadrian.com
Security News · therecord.media

Agencies Warn of Laundry Bear Zero-Click Attacks on Zimbra Webmail

· Original article ↗

Summary

Government agencies warn that Laundry Bear is exploiting CVE-2025-66376 in Zimbra webmail through malicious JavaScript in emails. They assess the activity as likely espionage and urge users to patch or switch mail clients.

Key points

  • Agencies report that Laundry Bear has targeted Ukrainian entities and later U.S., NATO, and other government and commercial organizations using Zimbra Collaboration Suite.
  • Since at least July 2025, the group has exploited CVE-2025-66376 by hiding malicious JavaScript in emails; the payload runs when an email is opened.
  • The campaign has targeted government, defense, transportation, financial, and high-science organizations across several regions.
  • The advisory says attackers attempted to obtain recent emails, passwords, contact lists, two-factor authentication tokens, and other passcodes.
  • The agencies assess the activity as likely Russian government-backed espionage, citing its covert nature and the absence of known financial extortion.
  • Zimbra users are urged to patch immediately or, if that is not feasible, use a different mail client.
  • Dutch intelligence says Laundry Bear's tactics overlap with Fancy Bear's but identifies them as different actors.

Article Details

Event Type
Reported Laundry Bear campaign exploiting CVE-2025-66376 in Zimbra webmail through zero-click phishing emails.
Impact
The campaign reportedly compromised government, defense, transportation, finance, and scientific organizations. Attackers attempted to exfiltrate up to 90 days of email, passwords, contact lists, two-factor authentication tokens, and other passcodes. Agencies urged affected organizations to patch Zimbra or use another mail client.

MITRE ATT&CK

T1566 · PhishingThe article describes zero-click phishing emails used in the campaign.

CVE

CVE-2025-66376#LaundryBear

Threat Actors

Fancy BearSeqrite attributed a separate March 2026 zero-click Zimbra phishing campaign compromising a Ukrainian maritime agency to Fancy Bear with medium confidence. Dutch intelligence said Laundry Bear's tactics overlap with Fancy Bear's but that they are different actors.Laundry BearThe article attributes the Zimbra campaign and its exploitation of CVE-2025-66376 to Laundry Bear, described as Russian state-aligned; agencies assessed the activity as almost certainly indicating espionage with Russian government backing.

Products

Zimbra Collaboration Suitehackers in the Laundry Bear campaign are using zero-click phishing emails to target Zimbra Collaboration Suite users across the West, with evidence pointing to espionage activity rather than financial

Countries

NetherlandsLaundry Bear was first identified in May 2025 by Dutch intelligence agencies, which blamed the group for a series of hacks in the Netherlands, including on the national police.RussiaRead More: https://therecord.media/zimbra-webmail-zero-click-phishing-russia-laundry-bearUkraine#LaundryBearUnited StatesThe operation has hit Ukrainian, U.S., NATO, and other government and commercial entities, prompting urgent patching guidance for Zimbra users.

Industries

DefenseThe campaign has targeted governments, defense, transportation, finance, and high science organizations.financeThe campaign has targeted governments, defense, transportation, finance, and high science organizations.GovernmentThe operation has hit Ukrainian, U.S., NATO, and other government and commercial entities, prompting urgent patching guidance for Zimbra users.TransportationThe campaign has targeted governments, defense, transportation, finance, and high science organizations.

Related Articles