Russian-Backed LAUNDRY BEAR Exploits Zimbra Flaw to Steal Email
Summary
A joint advisory details how Russian state-supported LAUNDRY BEAR exploits CVE-2025-66376 in Zimbra webmail to collect emails and account data, using Ulej and Flowerbed infrastructure for exfiltration.
Key points
- The agencies report that LAUNDRY BEAR has targeted Western government and commercial organizations using Zimbra since at least July 2025.
- A malicious email exploits CVE-2025-66376 to execute JavaScript when viewed in vulnerable webmail. The flaw was patched in November 2025.
- The encoded and XOR-encrypted payload attempts to collect 90 days of email, address lists, passwords and two-factor authentication scratch codes.
- The script attempts to enable IMAP and create an application passcode for persistent mailbox access.
- Ulej sends collected data over DNS and HTTPS to Flowerbed, where the Catcher service aggregates and stages it.
- Defenders should patch Zimbra, monitor SOAP requests and suspicious DNS traffic, and investigate localStorage entries named zd_comp_YYYY-MM-DD.
- Affected organizations should revoke application passcodes and scratch codes and require password changes.
Article Details
- Attack Vectors
- A malicious email exploits CVE-2025-66376 to execute JavaScript when viewed in vulnerable Zimbra webmail.
- The payload uses the victim’s authenticated session and SOAP requests to collect account information, credentials and email, then sends data to Flowerbed over DNS and HTTPS.
- In earlier activity, a fake sign-in site and modified Evilginx intercepted credentials and session tokens.
- Defensive Notes
- Apply the available ZCS patches; if immediate patching is not feasible, use alternative mail clients and avoid the Classic webmail client.
- Monitor outbound traffic to unfamiliar VPS infrastructure, suspicious DNS queries, recently established domains and unusual VPN connections.
- Review mailbox.log for bursts of SearchGalRequest, CreateAppSpecificPasswordRequest and GetScratchCodesRequest activity, and inspect browser localStorage for zd_comp_YYYY-MM-DD entries.
- Investigate and quarantine related malicious emails. Revoke Application Passcodes and 2FA scratch keys and require password changes following compromise.
- Consider passkey-capable third-party authentication and closely monitor Application Passcodes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | analyticemailmeter[.]com | Flowerbed server domain used for exfiltration and staging. |
| DOMAIN | emailanalytics[.]com[.]ua | Flowerbed server domain used for exfiltration and staging. |
| DOMAIN | istc-cloud[.]com | Flowerbed server domain used for exfiltration and staging. |
| DOMAIN | mailnalysis[.]com | Flowerbed server domain used for exfiltration and staging. |
| DOMAIN | synacorzimbra[.]nl | Flowerbed server domain used for exfiltration and staging. |
| DOMAIN | zimbra-metadata[.]com | Flowerbed server domain used for exfiltration and staging. |
| DOMAIN | zimbrasoft[.]com[.]ua | Flowerbed server domain used for exfiltration and staging. |
| DOMAIN | zimbrastat[.]com | Flowerbed server domain used for exfiltration and staging. |
| DOMAIN | zmailanalytics[.]com | Flowerbed server domain used for exfiltration and staging. |
c[.]laurent[.]ejfa@proton[.]me | Address used to distribute malicious campaign payloads. | |
garrysmithme@pinmx[.]net | Address used to procure campaign resources. | |
hostingclient@pinmx[.]net | Address used to procure campaign resources. | |
ivanka[.]zurabishvili@proton[.]me | Address used to procure campaign resources. | |
j[.]moreau[.]epsc@proton[.]me | Address used to distribute malicious campaign payloads. | |
liberty[.]insights@proton[.]me | Address used to distribute malicious campaign payloads. | |
zmul1@buildandconsulting[.]com | Address used to procure campaign resources. | |
| IPV4 | 104[.]248[.]134[.]194 | Flowerbed server IP associated with mailnalysis[.]com. |
| IPV4 | 185[.]86[.]79[.]95 | Flowerbed server IP associated with emailanalytics.com[.]ua. |
| IPV4 | 193[.]238[.]152[.]66 | Flowerbed server IP associated with zimbrasoft.com[.]ua. |
| IPV4 | 194[.]156[.]103[.]193 | Flowerbed server IP associated with istc-cloud[.]com. |
| IPV4 | 216[.]252[.]238[.]104 | Flowerbed server IP associated with zmailanalytics[.]com. |
| IPV4 | 216[.]252[.]238[.]18 | Flowerbed server IP associated with zimbra-metadata[.]com. |
| IPV4 | 216[.]252[.]238[.]64 | Flowerbed server IP associated with synacorzimbra[.]nl. |
| IPV4 | 37[.]120[.]247[.]228 | Flowerbed server IP associated with analyticemailmeter[.]com. |
| IPV4 | 64[.]226[.]124[.]190 | Flowerbed server IP associated with zimbrastat[.]com. |
| SHA256 | 1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760 | Hash of an email sample containing the malicious payload. |
| SHA256 | 60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874 | Hash of an email sample containing the malicious payload. |
| SHA256 | 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf | Hash of an email sample containing the malicious payload. |
| SHA256 | b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d | Hash of an email sample containing the malicious payload. |
MITRE ATT&CK
T1027.013 · Encrypted/Encoded FileThe inner collection and exfiltration script was Base64-encoded and XOR-encrypted.T1027.017 · SVG SmugglingThe email concealed a Base64-encoded payload in an SVG onload attribute.T1048.002 · Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolUlej sent account data and email archives to Flowerbed over HTTPS.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolUlej encoded smaller data items and sent them in DNS A-record queries to Flowerbed.T1074.002 · Remote Data StagingFlowerbed temporarily stored exfiltrated data on actor-controlled VPS infrastructure.T1087 · Account DiscoveryThe payload obtained the victim’s email identity and searched the Global Address List.T1098 · Account ManipulationThe script attempted to create an Application Passcode and enable IMAP for sustained mailbox access.T1114.002 · Remote Email CollectionThe script retrieved up to 90 days of email from the ZCS mail server.T1119 · Automated CollectionThe payload automatically collected account information and emails across asynchronous stages.T1185 · Browser Session HijackingThe script used the victim’s authenticated browser session and CSRF token to make ZCS SOAP requests.T1203 · Exploitation for Client ExecutionViewing a malicious email exploited CVE-2025-66376 and executed JavaScript in ZCS webmail.T1550.004 · Web Session CookieEarlier campaigns replayed stolen session tokens to circumvent multi-factor authentication.T1557 · Adversary-in-the-MiddleIn an earlier campaign, modified Evilginx intercepted credentials and session tokens at a fake sign-in site.T1560 · Archive Collected DataThe payload transmitted collected emails as GZIP-compressed archives.T1566 · PhishingLAUNDRY BEAR sent emails containing malicious JavaScript to targeted ZCS users.
CVE
Threat Actors
CL-STA-1114An industry tracking name listed for the Russian state-supported actors conducting the reported activity; the advisory cautions that groupings may not correspond exactly.Laundry BearThe advisory attributes the ZCS phishing and email-exfiltration campaign to this Russian state-supported group. It lists Void Blizzard, CL-STA-1114 and TA488 as overlapping industry tracking names, with a caveat that tracking may not correspond exactly.TA488Microsoft’s tracking name for the Russian state-supported actors discussed in the advisory; industry groupings may not correspond exactly to LAUNDRY BEAR.UNK_PitStopThe former tracking name for TA488, listed among names for the reported Russian state-supported actors; groupings may not correspond exactly.
Malware
Vendors
Products
Microsoft Exchangeadvisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [T1114.002].Zimbra Collaboration SuiteRussian state-supported actors tracked as LAUNDRY BEAR have been exploiting CVE-2025-66376 in Zimbra Collaboration Suite to steal email data and sensitive account information from Western organizations.
Tools
CatcherThe campaign uses a view-based phishing exploit, custom tooling called Ulej, and Flowerbed/Catcher infrastructure to collect and exfiltrate data via DNS and HTTPS.Evilginx[T1557] Adversary-in-the-Middle – Evilginx intercepted credentials and session tokens from a fake sign-in site (‘intercepted the user’s credentials’).Evilginx2[T1588.002] Obtain Capabilities: Tool – The group relied on Evilginx2 as an open source tool (‘open source capabilities, such as Evilginx2’).FlowerbedThe campaign uses a view-based phishing exploit, custom tooling called Ulej, and Flowerbed/Catcher infrastructure to collect and exfiltrate data via DNS and HTTPS.
Countries
RussiaLAUNDRY BEAR’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data.UkraineOperation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency.United StatesUnited States National Security Agency (NSA)
Industries
Defense industrial basethe Defense Industrial Base (DIB), GovernmentLAUNDRY BEAR, a Russian state-supported APT, has targeted Western government and commercial organizations since at least July 2025.MediaMedia Inquiries / Press Desk: NSA Media Relations: 443-634-0721, [email protected] Non-governmental organizationsnon-governmental organizations, and