LAUNDRY BEAR - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/laundry-bear/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 23 Jul 2026 14:41:39 +0000Russian State-Backed 'LAUNDRY BEAR' Exploits Zimbra Zero-Click Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-07-russian-laundry-bear-zimbra-zero-click/Thu, 23 Jul 2026 14:41:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-russian-laundry-bear-zimbra-zero-click/The Russian state-supported threat group LAUNDRY BEAR is exploiting a zero-click vulnerability, dubbed 'beehive,' in the Zimbra Collaboration Suite (ZCS) webmail service, actively stealing sensitive emails and gaining persistent access to compromised networks since July 2025 by merely viewing a malicious email, with Western organizations across various sectors being targeted.GCHQ’s National Cyber Security Centre (NCSC) and international partners have exposed LAUNDRY BEAR, a Russian state-supported advanced persistent threat (APT) group, for an ongoing zero-click phishing campaign. Active since July 2025, this campaign leverages a previously unknown exploit, internally dubbed "beehive" (or "Ulej"), targeting vulnerable versions of Zimbra Collaboration Suite (ZCS) webmail services. Unlike traditional phishing, the "beehive" exploit allows the attackers to gain extensive and sustained access to sensitive email information and compromised networks without any user interaction beyond viewing a malicious email. The campaign, which was initially trialed on Ukrainian victims, has subsequently targeted numerous Western organizations across sectors including defence, government, education, energy, law enforcement, media, NGOs, and technology, indicating an espionage objective to covertly acquire email data. The use of Artificial Intelligence in developing the codebase for this operation has also been noted.

Attack Chain

  1. The LAUNDRY BEAR threat group, with Russian state support, sends a specially crafted malicious email to a target organization using a vulnerable Zimbra Collaboration Suite (ZCS) instance.
  2. A user within the target organization views the malicious email in their ZCS webmail client.
  3. Upon viewing, the "beehive" zero-click exploit is automatically triggered within the vulnerable ZCS software, requiring no further user interaction (e.g., clicking a link or opening an attachment).
  4. The exploit grants the attackers extensive and sustained access to the target user's email account.
  5. Attackers proceed to steal sensitive email information from the compromised account.
  6. The threat actors establish persistent access to the compromised email system or broader network, facilitating long-term espionage activities.

Impact

The LAUNDRY BEAR campaign has resulted in the successful theft of sensitive email information and persistent access to compromised networks for espionage purposes. Since July 2025, organizations utilizing Zimbra Collaboration Suite (ZCS) have been targeted, with specific victim sectors in the US including defence, government, education, energy, law enforcement, media, NGOs, and technology. The techniques were first observed being tested on Ukrainian victims before being deployed against NATO member countries. A successful attack can lead to the exfiltration of confidential communications, intellectual property, and other critical data, posing significant national security and economic risks.

Recommendation

]]>criticalthreatphishingzero-clickespionagestate-sponsoredzimbraemail-theftTA488 Exploits Zimbra Mailservers with Half-Click Vulnerability CVE-2025-66376https://feed.craftedsignal.io/briefs/2026-07-ta488-zimbra-half-click/Thu, 23 Jul 2026 14:04:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-ta488-zimbra-half-click/Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.Proofpoint, in coordination with the NSA and FBI, has identified TA488 (also known as Void Blizzard or Laundry Bear), a Russia-aligned threat actor, exploiting a critical cross-site scripting (XSS) vulnerability, CVE-2025-66376, in Zimbra Collaboration Suite mailservers. This campaign, active for at least five months during 2025, leveraged a "half-click" exploit, meaning victims needed only to open or preview a specially crafted email for malicious JavaScript to execute. The attacks primarily targeted Ukrainian government entities, along with US government, high science, and defense industrial base organizations. After successful exploitation, TA488 established persistent access to compromised systems, stole credentials and two-factor authentication codes, and exfiltrated emails using a custom malware Proofpoint tracks as "ZimReaper." The actor's use of this stealthy method underscores a continued focus by Russian state-sponsored groups on exploiting webmail vulnerabilities to achieve espionage objectives.

Attack Chain

  1. Initial Access & Exploitation (CVE-2025-66376): TA488 sends specially crafted emails from adversary-controlled Proton Mail accounts or previously compromised addresses. These emails contain an embedded HTML/JavaScript payload that exploits CVE-2025-66376 by using tag-splitting techniques with fake CSS @import directives and HTML comments to bypass Zimbra's client-side HTML sanitizer.
  2. Client-Side JavaScript Execution: When a victim opens or previews the malicious email in a vulnerable Zimbra webmail client, the sanitizer fails, allowing the browser to reconstruct and execute the embedded JavaScript (ZimReaper) within the context of the user's authenticated webmail session.
  3. Obfuscation & Persistence Check: The initial JavaScript, after execution, checks for a script element with the ID zmb_pl_v3_ to avoid re-execution and subsequently XOR decrypts a second, obfuscated JavaScript payload.
  4. Credential & System Information Collection: The decrypted ZimReaper JavaScript pings the attacker's C2 server to log the successful exploit and then proceeds to steal the Cross-Site Request Forgery (CSRF) token, auto-complete passwords, two-factor authentication codes, and details about the Zimbra installation from the browser.
  5. Persistence Establishment: ZimReaper utilizes Zimbra APIs, specifically CreateAppSpecificPasswordRequest, to generate a new app-specific password under the name "ZimbraWeb." This password provides TA488 with persistent access to the mailserver via IMAP, POP3, or SMTP, bypassing 2FA requirements.
  6. Data Exfiltration via DNS Queries: The collected sensitive information, including 2FA scratch codes, Zimbra version, user email, the newly created app-specific password, auto-fill password, and the Zimbra server URL, is exfiltrated to the C2 server via DNS queries using a specific key.Base32EncodedData.unique_identifier.domain schema.
  7. Bulk Email Exfiltration via HTTP POST: ZimReaper iterates through up to 90 days of the targeted user's emails. It then leverages Zimbra's built-in export functionality to exfiltrate these messages as a TGZ (compressed tarball) file through an HTTP POST request to the attacker's C2 infrastructure.

Impact

The successful exploitation of CVE-2025-66376 by TA488 results in significant compromise of targeted organizations, particularly within government, high science, and the defense industrial base sectors. The primary impact is the unauthorized exfiltration of sensitive email communications, user credentials, and two-factor authentication codes, leading to a severe loss of confidentiality. Furthermore, the establishment of persistent access via app-specific passwords enables the threat actor to maintain long-term presence within the mail environment, potentially send further spear-phishing campaigns from compromised legitimate accounts, or continue manual data exfiltration. The targeting of Ukrainian government entities and US defense contractors indicates a clear espionage objective, posing a national security risk.

Recommendation

  • Patch CVE-2025-66376 on all Zimbra Collaboration Suite mailservers immediately to prevent exploitation.
  • Deploy the Sigma rule "Detect ZimReaper DNS Exfiltration Activity" to your SIEM and monitor for suspicious DNS queries that match the described pattern (key.Base32EncodedData.unique_identifier.domain).
  • Deploy the Sigma rule "Detect ZimReaper Bulk Email Exfiltration via Webmail Export" to your SIEM and monitor Zimbra webserver logs for HTTP POST requests to /service/export with fmt=tgz.
  • Review Zimbra audit logs for the creation of new app-specific passwords, particularly those named "ZimbraWeb", which may indicate unauthorized persistence.
  • Enhance email gateway security to detect and block emails containing complex, obfuscated HTML/JavaScript payloads, especially those targeting known Zimbra vulnerabilities.
]]>criticalthreatespionagexsszimbraaptstate-sponsoredhalf-clickcve-2025-66376