Key Takeaways
- Russian cyber‑espionage group Laundry Bear (also tracked as Void Blizzard) has been exploiting a cross‑site scripting (XSS) flaw in Zimbra Collaboration Suite (CVE‑2025‑66376) since at least July 2025.
- The attack requires only that a victim view a malicious HTML email; no link clicks or file openings are needed.
- Stolen data include the last 90 days of email, address books, passwords, two‑factor authentication tokens, and newly generated application passcodes, allowing persistent access to compromised accounts.
- The attackers store exfiltrated information on an unattributable virtual private server running a custom Python‑based “Flowerbed” framework, which shows signs of AI‑assisted development.
- A joint alert from 27 US, UK, and other international agencies provides detailed indicators of compromise (IOCs) and urges organizations to limit use of the Zimbra webmail client until they apply the November 2025 patch.
Overview of the Laundry Bear Campaign
Since mid‑2025, the Russian‑linked threat actor Laundry Bear—also known as Void Blizzard—has conducted a sustained espionage campaign targeting Western government and commercial networks. The group’s primary objective, as stated in a joint security alert issued by 27 US, UK, and allied agencies, is the covert acquisition of email data to support Russian intelligence interests. The campaign has been observed across a broad range of sectors, including defense, energy, law enforcement, media, NGOs, and technology, indicating a strategic focus on high‑value information repositories.
Technical Details of the Zimbra Exploit
The intrusion hinges on CVE‑2025-66376, a cross‑site scripting vulnerability present in the Zimbra Collaboration Suite (ZCS) web‑based email platform. Although a patch was released in November 2025, Laundry Bear began exploiting the flaw months earlier, taking advantage of the window between disclosure and remediation. The XSS flaw allows an attacker to inject malicious JavaScript into web pages rendered by the Zimbra interface, enabling code execution within the victim’s browser context without any additional user action.
Attack Vector and User Interaction Requirements
Unlike traditional phishing that relies on tricking users into clicking links or opening attachments, this campaign delivers its payload via HTML‑formatted email messages. When the recipient merely opens or previews the email in the Zimbra webmail client, the embedded JavaScript executes automatically. Consequently, the attack succeeds with zero interaction beyond viewing the message, dramatically lowering the barrier for successful compromise and increasing the stealth of the operation.
Data Exfiltrated and Impact
Once the malicious script runs, it harvests a substantial trove of information from the victim’s mailbox. Exfiltrated data include the last 90 days of email correspondence, complete address books (including global address lists), plain‑text passwords, two‑factor authentication (OTP) tokens, and any newly generated application passcodes. With these credentials, Laundry Bear can maintain persistent access to the compromised account, alter mailbox settings, and continue harvesting fresh data long after the initial breach.
Infrastructure and Tooling: Flowerbed Framework
The stolen information is uploaded to an unattributable virtual private server (VPS) operated by the attackers. On this server resides a custom collection framework dubbed “Flowerbed,” implemented in Python and containerized with Docker. The framework automates the gathering, staging, and exfiltration of harvested data. Notably, the joint alert highlights that the Flowerbed codebase contains indicators suggesting the involvement of artificial intelligence techniques during its development, possibly to optimize evasion or data‑selection routines.
Indicators of Compromise and Attribution
The 31‑page security alert accompanying the campaign includes an extensive IOC section, listing malicious email addresses (e.g., ivanka.zurabishvili@proton[.]me, zmul1@buildandconsulting[.]com), associated domains, file hashes, and network signatures linked to the Flowerbed infrastructure. Analysts have attributed the activity to Laundry Bear with high confidence, citing overlapping TTPs (tactics, techniques, and procedures) with previously observed Russian cyber‑espionage operations and the group’s known focus on email‑centric intelligence gathering.
Recommendations for Organizations
To mitigate risk, the advisory urges organizations to:
- Restrict or disable the use of the Zimbra webmail client until the November 2025 patch for CVE‑2025-66376 is applied.
- Apply the patch promptly across all Zimbra installations and verify version compliance.
- Enforce multifactor authentication that is resistant to token theft (e.g., hardware‑based FIDO2 keys).
- Monitor for the listed IOCs in email gateways, endpoint detection systems, and network traffic.
- Educate users about the danger of merely viewing suspicious emails, emphasizing that traditional “don’t click” advice is insufficient against this vector.
Patch Status and Mitigation Guidance
CVE‑2025-66376 was formally patched in the Zimbra Collaboration Suite release of November 2025. Organizations still running older versions remain exposed to the zero‑click XSS exploit. The advisory recommends upgrading to the patched release or, if immediate upgrade is infeasible, implementing strict content‑security policies that block inline JavaScript in webmail and isolating the webmail service behind a robust web‑application firewall (WAF). Continuous vulnerability scanning and penetration testing are also advised to ensure no residual exposure persists.
Conclusion and Ongoing Threat Landscape
The Laundry Bear campaign exemplifies an evolution in Russian cyber‑espionage tactics: leveraging a seemingly benign web‑application flaw to achieve zero‑click, high‑yield data theft. By eliminating the need for user interaction beyond email preview, the group maximizes infection rates while minimizing forensic traces. The breadth of targeted sectors underscores a strategic aim to collect diplomatic, military, economic, and technological intelligence. As long as unpatched Zimbra instances remain accessible, similar attacks are likely to persist. Vigilant patch management, hardened email client configurations, and proactive threat‑hunting based on the supplied IOCs are essential defenses against this and future iterations of the threat.