Skip to content
Threat Feed
Subscribe

Actor

Laundry Bear

2 briefs RSS
critical threat

Russian State-Backed 'LAUNDRY BEAR' Exploits Zimbra Zero-Click Vulnerability

The Russian state-supported threat group LAUNDRY BEAR is exploiting a zero-click vulnerability, dubbed 'beehive,' in the Zimbra Collaboration Suite (ZCS) webmail service, actively stealing sensitive emails and gaining persistent access to compromised networks since July 2025 by merely viewing a malicious email, with Western organizations across various sectors being targeted.

Zimbra Collaboration Suite LAUNDRY BEAR phishing zero-click espionage state-sponsored zimbra email-theft
3t
critical threat

TA488 Exploits Zimbra Mailservers with Half-Click Vulnerability CVE-2025-66376

Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.

Zimbra Collaboration Suite +2 TA488 +2 espionage xss zimbra apt state-sponsored half-click cve-2025-66376
2r 9t 1c