Laundry Bear Group Targets Unpatched Zimbra Servers
US agencies warn of Russian-linked hackers exploiting security vulnerability.
1Threat Scope
Leading US cybersecurity agencies revealed that Russia-linked APT group Laundry Bear (Void Blizzard) is exploiting a vulnerability in Zimbra Collaboration servers. The group uses malicious JavaScript in emails to automatically compromise accounts on unpatched systems without user interaction.
2Zero-Click Attack
Unlike traditional phishing requiring user action, this attack only needs email viewing. The XSS vulnerability CVE-2025-66376 allows embedded malicious code in HTML emails to execute automatically, stealing account credentials without clicks or downloads.
3Attack Mechanism
Attackers first send phishing emails from compromised accounts. Hidden Base64-encoded payloads in SVG elements execute via CSS @import directives when viewed in Zimbra webmail. The encrypted payload deploys multi-stage malware for reconnaissance and credential theft.
4Data Collection Methods
The malware maintains persistent access by enabling IMAP, creating app passwords, and harvesting 2FA codes. It collects sensitive data including 90 days of emails, contacts, OAuth consumers, and browser-stored passwords from password managers.
5Exfiltration Channels
Stolen data is exfiltrated via HTTPS and DNS to attacker-controlled infrastructure called Flowerbed. A dedicated service named Catcher temporarily stores the data. Attackers use deceptive domains mimicking legitimate Zimbra infrastructure for operations.
6Mitigation Measures
CISA urges Zimbra users to apply latest security patches. Organizations should review published IOCs, revoke unauthorized app passwords, and implement phishing-resistant MFA. Monitoring for abnormal authentication activity and checking for unauthorized mailbox access is critical.
Original article: Security Affairs — Laundry Bear Grubu Zimbra Sunucularını Hedef Alıyor