Full Report
Laundry Bear exploits a Zimbra zero-click vulnerability (CVE-2025-66376) to steal 90 days of email, session cookies and application passcodes without victims clicking a link.
Analysis Summary
# Threat Actor: Laundry Bear
## Attribution & Identity
- **Actor Identification:** Laundry Bear (also known as APT28, Fancy Bear, or Strontium).
- **Aliases:** APT28, Fancy Bear, Forest Blizzard, Pawn Storm.
- **Known Associations:** Attributed to the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS).
## Activity Summary
Recent operations involve the exploitation of a "zero-click" vulnerability in Zimbra collaboration software. Unlike traditional phishing that requires a user to click a link or open an attachment, this campaign triggers malicious code execution simply by the victim viewing a specially crafted email. The campaign focuses on high-volume data exfiltration and maintaining persistent access to compromised mailboxes.
## Tactics, Techniques & Procedures
- **Zero-Click Exploitation:** Exploiting CVE-2025-66376 (Zimbra) to execute code via the webmail interface without user interaction.
- **Data Exfiltration:** Automatically stealing up to 90 days of email history from the victim's account.
- **Credential & Session Theft:** Stealing session cookies to bypass Multi-Factor Authentication (MFA).
- **Persistence:** Secretly creating "application passcodes." These allow the actor to maintain access even if the primary account password is changed.
- **MITRE ATT&CK IDs:**
- T1190: Exploit Public-Facing Application
- T1114.002: Email Collection (Remote Email Services)
- T1539: Steal Web Session Cookie
- T1136: Create Account (Application-specific passcodes)
## Targeting
- **Sectors:** Government, Defense, International Organizations, and Critical Infrastructure.
- **Geography:** Focused on European countries, particularly those within NATO or the EU, and global organizations of interest to Russian intelligence.
- **Victims:** Organizations utilizing unpatched Zimbra collaboration servers.
## Tools & Infrastructure
- **Vulnerability:** CVE-2025-66376 (Zimbra zero-click flaw).
- **Malware/Scripts:** Custom scripts used to automate the exfiltration of 90 days of emails and session data.
- **Infrastructure:**
- Compromised Zimbra servers.
- Command and Control (C2) domains used for data exfiltration and hosting malicious scripts (specific URLs/IPs not provided in the article, but typically involve actor-controlled or compromised legitimate infrastructure).
- *General Recommendation:* Defang indicators such as `hxxps[:]//example[.]com` or `192[.]168[.]1[.]1`.
## Implications
The shift to "zero-click" vulnerabilities represents a significant escalation in threat capability. It removes the "human element" from the initial infection chain, making traditional security awareness training (e.g., "don't click links") insufficient. The use of application passcodes specifically targets long-term intelligence gathering, ensuring that even standard remediation efforts (password resets) do not evict the actor.
## Mitigations
- **Patching:** Immediately update Zimbra collaboration servers to the latest version to remediate CVE-2025-66376.
- **Forensic Investigation:** Organizations using Zimbra should audit logs for signs of unauthorized access prior to patching.
- **Access Audit:** Specifically check for the creation of unauthorized "application passcodes" or new API keys within mail accounts.
- **Session Management:** Force-expire all active sessions and clear session cookies across the organization following a patch.
- **Defense-in-Depth:** Use web application firewalls (WAF) to filter malicious requests targeting known mail server vulnerabilities.