Full Report
A Kremlin-backed group known as Laundry Bear has been using a zero-click phishing technique to break into Zimbra webmail accounts worldwide, the U.S. and other nations said.
Analysis Summary
# Threat Actor: Laundry Bear
## Attribution & Identity
- **Actor Name:** Laundry Bear
- **Known Aliases:** TA488 (Proofpoint), Void Blizzard (Microsoft)
- **Associated Groups:** Exhibits tactical overlaps with **Fancy Bear** (APT28), though intelligence agencies (notably Dutch intelligence) currently distinguish them as separate actors.
- **Backing:** Russian state-aligned; almost certainly backed by the Russian government for intelligence gathering.
## Activity Summary
Laundry Bear has been conducting a global espionage campaign since at least July 2025, specifically targeting the Zimbra Collaboration Suite. The group initially focused on Ukrainian entities—using the region as a "testbench"—before expanding operations to target U.S., NATO, and European governmental and commercial organizations.
## Tactics, Techniques & Procedures
- **Zero-Click Phishing:** Deployment of malicious emails that execute payloads immediately upon being opened, requiring no user interaction (unlike traditional "half-click" or link-based phishing).
- **Cross-Site Scripting (XSS):** Hiding malicious JavaScript payloads within emails to compromise webmail interfaces.
- **Exploitation of Known Vulnerabilities:** Exploiting **CVE-2025-66376**, a vulnerability in Zimbra first patched in November 2025.
- **Credential & Data Theft:** Automated exfiltration of:
- Last 90 days of emails.
- Passwords and contact lists.
- Two-factor authentication (2FA) tokens and passcodes.
- **Historical Tactics:** Previously utilized less sophisticated methods such as password spraying and traditional link-based phishing.
## Targeting
- **Sectors:** Defense Industrial Base (DIB), Transportation, Government, High Science, Financial Organizations, and Law Enforcement/National Police.
- **Geography:** Ukraine (primary/initial target), United States, Netherlands, NATO member states, Commonwealth of Independent States (CIS) countries, and Africa.
- **Victims:** Netherlands National Police, Ukrainian maritime agencies, and various unspecified governmental/commercial organizations globally.
## Tools & Infrastructure
- **Malware:** Custom JavaScript payloads used for webmail exploitation.
- **Infrastructure:**
- Usage of previously compromised email accounts to send phishing lures, increasing the appearance of legitimacy.
- Specialized scripts designed to "pillage" webmail servers.
- *Note: Specific C2 domains and IP addresses were not listed in the provided text.*
## Implications
Laundry Bear represents a persistent espionage threat characterized by a shift from unsophisticated methods to highly effective zero-click techniques. The group’s strategy of using Ukraine as a testing ground suggests that new TTPs observed in Eastern Europe are likely to be deployed against NATO and U.S. targets shortly thereafter. The focus on 2FA token theft indicates a capability to bypass modern security perimeters.
## Mitigations
- **Immediate Patching:** Prioritize the remediation of **CVE-2025-66376** on all Zimbra Collaboration Suite instances.
- **Alternative Clients:** If patching is not immediately feasible, organizations are advised to transition users from the Zimbra webmail interface to thick-client mail applications (e.g., Outlook, Thunderbird).
- **Monitoring:** Implement logging to detect unusual JavaScript execution or unauthorized API calls within webmail environments.
- **Token Invalidation:** Force password resets and session terminations if a compromise is suspected, as the actor specifically targets session tokens.