Cyber espionage groups backed by the Russian government exploited a previously unknown vulnerability in the Zimbra Collaboration Suite (ZCS) in order to steal emails, browser credentials, and two-factor authentication (2FA) recovery codes from government and commercial organizations throughout the world, according to a joint cybersecurity advisory issued by the U.S. National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and international partners.
In the campaign, CVE-2025-66376 was used to exploit a stored cross-site scripting (XSS) vulnerability affecting Zimbra's Classic Web Client. According to Proofpoint, the flaw was exploited as a zero-day attack for at least five months before a security patch was available in November 2025, identified by Palo Alto Networks Unit 42 as CL-STA-1114.
It is reported by the Dutch General Intelligence and Security Service (AIVD) that the activity is referred to as Laundry Bear, while cybersecurity vendors continue to use different tracking names for the same or similar threats.
The vulnerability allowed attackers to compromise users by merely opening or previewing a specially crafted HTML email in a Zimbra session that was vulnerable.
Upon activating the malicious JavaScript within the authenticated webmail session, attackers gained access to the victim's mailbox without requiring additional interaction from them.
The campaign has been described as a "half-click" phishing attack by security researchers, as the victim only needed to browse or open the malicious email in Zimbra's Classic Web Client to gain access.
As opposed to conventional phishing campaigns that require the user to click links or download attachments, the exploit executed automatically when the email was rendered, which permitted the execution of arbitrary JavaScript within the authenticated webmail session.
According to researchers, the ZimReaper malware harvested emails from the last 90 days, the organization's Global Address List, browser-stored passwords, details on Zimbra versions and recovery codes for two-factor authentication.
Besides exfiltrating data through DNS queries, attackers also created app-specific passwords for retaining persistent access to compromised accounts even after password changes.
In accordance with the advisory, the campaign targeted government, military, transportation, financial, and scientific organizations throughout NATO member countries, Ukraine, the Commonwealth of Independent States, Africa, and the United States.
Researchers did not disclose the number or identities of affected organizations. The operation is believed to have been conducted in support of Russian intelligence objectives to gather sensitive information.
One of the longest-running known exploit campaigns against Zimbra was launched in July 2025, according to intelligence officials. It was publicly disclosed and patched in August 2025, making it one of the longest-running known exploit campaigns.
Versions 10.0.18 and 10.1.13 of Zimbra addressed the vulnerability, while CISA added it to its Known Exploited Vulnerabilities (KEV) catalog in March of 2026.
According to security experts, applying a patch alone will not be sufficient if a system has been compromised since the update occurred. Although Zimbra released a fix in November 2025, the vulnerability was not assigned a CVE identifier until several weeks later and was publicly documented.
It has been argued that the delayed disclosure may have contributed to organizations remaining unaware of the active threat while attackers continued to exploit vulnerable servers.
In addition to upgrading to supported Zimbra releases, organizations are advised to reset passwords for accounts that may be affected, invalidate active sessions, generate 2FA recovery codes, remove unauthorized passwords for applications, and review logs for suspicious activities.
Admins should also monitor for unusual DNS requests and inspect email correspondence for indicators associated with the exploit.
Furthermore, Proofpoint researchers warned that other threat actors have continued exploiting unpatched Zimbra servers, indicating that the vulnerability is still appealing beyond the Russian espionage campaign that originally exploited it.
Additionally, the researchers noted that although no evidence has been provided to suggest that the exploit itself was created using artificial intelligence, large language models may assist attackers in identifying future methods for bypassing security patches.
Despite the absence of activity from the threat group since February 2026, Unit 42 and government agencies remain concerned that attackers continue to target Zimbra environments that are not patched. The advisory warns that Russian espionage actors are likely to continue pursuing email platforms to support intelligence-gathering operations.
Several zero-day vulnerabilities have been exploited rapidly in this campaign, compromising trusted communication platforms. Organizations using Zimbra are encouraged to ensure that systems are fully patched, review accounts for signs of compromise, revoke unauthorized access, and continuously monitor their environments as a preventative measure against persistent espionage.
