Officials Say Laundry Bear Used Zimbra Zero-Day to Steal Sensitive Data
Summary
A joint advisory says Russian-linked Laundry Bear exploited Zimbra CVE-2025-66376 from July 2025 until its November patch, using a no-click view to steal emails, passwords and 2FA tokens. Unpatched systems remain targeted.
Key points
- A joint advisory from the United States and allied countries says Laundry Bear, also known as Void Blizzard, exploited Zimbra Collaboration Suite CVE-2025-66376 beginning in July 2025.
- The exploit reportedly required only viewing a target and could expose 90 days of email, passwords, search history, email directories and two-factor authentication tokens.
- Officials said unpatched Zimbra instances remain under active exploitation; the vulnerability was patched in November 2025.
- The advisory attributes the activity to Russian government-backed espionage and says targets included government, defense, education, energy and other sectors.
- Officials described a custom JavaScript payload delivered through phishing and a data-exfiltration and aggregation capability called “beehive.”
- Authorities released indicators of compromise and mitigation steps and urged organizations to update vulnerable software.
Article Details
- Vulnerability Types
- Zero-day vulnerability
- Severity
- Medium (6.1)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Threat Actors
Laundry BearOfficials identify Laundry Bear as a Russian state-sponsored group that exploited the Zimbra vulnerability to steal sensitive data; officials assess its espionage involvement as almost certain.TA488The article identifies Void Blizzard as another name for Laundry Bear, which officials say exploited the Zimbra vulnerability to steal sensitive data.
Products
Industries
DefenseThe group has targeted governments and organizations across many sectors, including defense and energy.EducationThe state-sponsored espionage group, also known as Void Blizzard, has compromised governments and organizations in the defense, education, energy, law enforcement, media, finance, transportation and technology sectors.EnergyThe group has targeted governments and organizations across many sectors, including defense and energy.financeThe state-sponsored espionage group, also known as Void Blizzard, has compromised governments and organizations in the defense, education, energy, law enforcement, media, finance, transportation and technology sectors.Law enforcementThe state-sponsored espionage group, also known as Void Blizzard, has compromised governments and organizations in the defense, education, energy, law enforcement, media, finance, transportation and technology sectors.MediaThe state-sponsored espionage group, also known as Void Blizzard, has compromised governments and organizations in the defense, education, energy, law enforcement, media, finance, transportation and technology sectors.TechnologyThe state-sponsored espionage group, also known as Void Blizzard, has compromised governments and organizations in the defense, education, energy, law enforcement, media, finance, transportation and technology sectors.TransportationThe state-sponsored espionage group, also known as Void Blizzard, has compromised governments and organizations in the defense, education, energy, law enforcement, media, finance, transportation and technology sectors.