The campaign combines phishing techniques with the exploitation of a Zimbra security vulnerability that has since been patched. CISA said the group has compromised organizations linked to the Defense Industrial Base (DIB), federal and local governments, educational institutions, energy companies, law enforcement agencies, media organizations, non-governmental organizations, and the technology sector.
At the centre of the campaign is CVE-2025-66376, a cross-site scripting (XSS) vulnerability in the Classic UI of Zimbra Collaboration Suite. The flaw could allow malicious JavaScript contained within specially crafted HTML emails to execute when the message was opened. This means attackers could potentially steal sensitive account information without requiring victims to click on a malicious link or access a fraudulent website.
CISA said Laundry Bear used the vulnerability as a zero-day before Zimbra released a patch in November 2025. Despite the availability of a fix, the group continues to target organizations operating vulnerable and unpatched Zimbra servers. CISA subsequently classified the vulnerability as being actively exploited.
The exploitation enables attackers to collect a wide range of information from compromised accounts. According to CISA, this includes a victim's emails from the previous 90 days, email address, password, Global Address List (GAL), and two-factor authentication (2FA) tokens.
The attackers can also generate and send a new Zimbra application passcode. Such passcodes are used by older email clients, including IMAP and ActiveSync, that cannot use TOTP-based authentication. By obtaining an application passcode, attackers can maintain access to compromised accounts even when multi-factor authentication (MFA) is enabled.
Data Exfiltration Through DNS and HTTPS
CISA said Laundry Bear transfers stolen information to infrastructure controlled by the attackers using both DNS and HTTPS. The group relies on its "Flowerbed" collection framework to receive the stolen data.
Smaller pieces of information are encoded and transmitted through DNS A-record queries, while larger datasets, including mailbox contents, are sent over HTTPS. The larger data packages are compressed before being uploaded to attacker-controlled servers.
The campaign is not limited to exploiting Zimbra's vulnerability. Laundry Bear has also deployed adversary-in-the-middle (AiTM) phishing kits that mimic genuine Zimbra login pages. These fraudulent portals are designed to capture users' credentials and session cookies, potentially allowing attackers to take over email accounts.
CISA's indicators of compromise identified several domains designed to resemble legitimate Zimbra-related infrastructure. These include 'mailnalysis.com', 'emailanalytics.com.ua', 'zimbrastat.com', 'zimbra-metadata.com', 'istc-cloud.com', and 'zmailanalytics.com'.
CISA Issues Security Recommendations
Organizations using Zimbra Collaboration Suite have been advised to take several steps to reduce the risk of compromise. CISA recommends:
Updating Zimbra Collaboration Suite to the latest available version and applying all security patches.
Reviewing CISA's published indicators of compromise.
Checking networks and systems for communications with the identified domains and IP addresses.
Monitoring accounts for unusual or suspicious authentication activity.
Revoking unauthorized application passcodes, particularly those containing the 'ZimbraWeb'.
Examining user accounts for signs of unauthorized mailbox access.
Deploying phishing-resistant MFA wherever technically possible.
Laundry Bear's Growing Cyber Espionage Activity
Laundry Bear was publicly linked to Russian cyber espionage activity in May 2025, when Dutch intelligence agencies attributed the group to a 2024 intrusion into the Dutch National Police. The incident resulted in the exposure of personal information belonging to police personnel and helped authorities identify a previously unknown Russian espionage operation.
Microsoft tracks the group as Void Blizzard. The threat actor has reportedly been active since at least 2024, focusing on intelligence-gathering operations against organizations considered strategically relevant to Russia. Its activity has largely centred on NATO member countries and Ukraine.
Microsoft has also reported successful intrusions into organizations supporting Ukraine, including those operating in the defense, transportation, and aviation industries.
Laundry Bear has previously used phishing as part of its operations. Earlier in 2026, a separate campaign attributed to the group targeted Ukraine's military with charity-themed phishing messages. The emails reportedly attempted to distribute malware disguised as donation-related requests.
The latest campaign highlights the continued risk posed by unpatched collaboration and email platforms, particularly when attackers combine software vulnerabilities with credential theft and phishing techniques to maintain long-term access to sensitive communications.
