cyber.hendryadrian.com
Security News · bleepingcomputer.com

CISA Warns Laundry Bear Hackers Are Exploiting Zimbra Flaw to Steal Email

· Original article ↗

Summary

CISA says Russian state-sponsored group Laundry Bear exploits Zimbra's CVE-2025-66376 and uses phishing to steal email data and bypass MFA. The advisory describes affected sectors and recommends patching and reviewing accounts.

Key points

  • CISA says Laundry Bear, also known as Void Blizzard, targeted and compromised users at organizations across government, defense, education, energy, media, and other sectors.
  • The group exploited the now-patched Zimbra CVE-2025-66376 XSS flaw, which can run JavaScript in a specially crafted HTML email when viewed, without a click.
  • CISA says the exploit collects victims' recent email, addresses, passwords, Global Address List data, and 2FA tokens.
  • The attackers reportedly create Zimbra application passcodes to retain email access and bypass MFA.
  • Stolen information is sent over DNS and HTTPS to servers running the group's Flowerbed collection framework.
  • Laundry Bear also uses adversary-in-the-middle phishing kits that imitate Zimbra login portals to steal credentials and session cookies.
  • CISA recommends updating Zimbra, reviewing indicators and suspicious connections, monitoring authentication, revoking unauthorized passcodes, and using phishing-resistant MFA where possible.

Article Details

Event Type
Cyberespionage campaign exploiting a Zimbra XSS vulnerability and using AiTM phishing to steal email data.
Impact
According to CISA, the campaign compromised or targeted organizations across government, defense, education, energy, law enforcement, media, NGOs, and technology. Stolen data included emails, passwords, Global Address List data, and 2FA tokens; attackers also created application passcodes to retain account access and bypass MFA.

Indicators of compromise

TypeIndicatorContext
DOMAINemailanalytics[.]com[.]uaListed as a campaign domain impersonating Zimbra infrastructure.
DOMAINistc-cloud[.]comListed as a campaign domain impersonating Zimbra infrastructure.
DOMAINmailnalysis[.]comListed as a campaign domain impersonating Zimbra infrastructure.
DOMAINzimbra-metadata[.]comListed as a campaign domain impersonating Zimbra infrastructure.
DOMAINzimbrastat[.]comListed as a campaign domain impersonating Zimbra infrastructure.
DOMAINzmailanalytics[.]comListed as a campaign domain impersonating Zimbra infrastructure.

MITRE ATT&CK

T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolStolen data was transmitted in DNS A-record queries to an actor-controlled server.T1114 · Email CollectionThe campaign collected victims' email and mailbox data.T1557 · Adversary-in-the-MiddleCISA reports the group used adversary-in-the-middle phishing kits to steal credentials and session cookies.

CVE

CVE-2025-66376known as Void Blizzard, is targeting Zimbra Collaboration servers with phishing and the now-patched CVE-2025-66376 XSS flaw to steal email data and bypass MFA.

Threat Actors

Laundry BearCISA attributes the reported Zimbra exploitation, phishing, and email-data theft campaign to Laundry Bear.TA488Microsoft tracks the group identified by CISA as Laundry Bear under the name Void Blizzard.

Products

Zimbra Collaboration SuiteThe attackers exploit the Zimbra CVE-2025-66376 flaw, a cross-site scripting (XSS) vulnerability affecting Zimbra Collaboration Suite’s Classic UI.

Tools

FlowerbedThe campaign has hit organizations across government, defense, education, energy, media, and NGOs, while exfiltrating stolen information through the group’s Flowerbed framework and AiTM phishing kits.

Countries

UkraineLaundry Bear targeted governments, police, and Ukraine

Industries

AviationMicrosoft has also documented successful compromises of organizations supporting Ukraine, including entities in the defense, transportation, and aviation sectors.DefenseThe campaign has hit organizations across government, defense, education, energy, media, and NGOs, while exfiltrating stolen information through the group’s Flowerbed framework and AiTM phishing kits.EducationThe campaign has hit organizations across government, defense, education, energy, media, and NGOs, while exfiltrating stolen information through the group’s Flowerbed framework and AiTM phishing kits.EnergyThe campaign has hit organizations across government, defense, education, energy, media, and NGOs, while exfiltrating stolen information through the group’s Flowerbed framework and AiTM phishing kits.GovernmentThe campaign has hit organizations across government, defense, education, energy, media, and NGOs, while exfiltrating stolen information through the group’s Flowerbed framework and AiTM phishing kits.Law enforcementassociated with the Defense Industrial Base (DIB), federal and local government, education, energy, law enforcement, media, non-governmental organizations, and technology.MediaThe campaign has hit organizations across government, defense, education, energy, media, and NGOs, while exfiltrating stolen information through the group’s Flowerbed framework and AiTM phishing kits.Non-governmental organizationsBase (DIB), federal and local government, education, energy, law enforcement, media, non-governmental organizations, and technology.Technologyand local government, education, energy, law enforcement, media, non-governmental organizations, and technology.TransportationMicrosoft has also documented successful compromises of organizations supporting Ukraine, including entities in the defense, transportation, and aviation sectors.

Related Articles