# Laundry Bear Group Targets Unpatched Zimbra Servers US agencies warn of Russian-linked hackers exploiting security vulnerability. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-07-24 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/3d8eabf1-e601-4ee7-8e40-061173e8dcd2 ## Threat Scope Leading US cybersecurity agencies revealed that Russia-linked APT group Laundry Bear (Void Blizzard) is exploiting a vulnerability in Zimbra Collaboration servers. The group uses malicious JavaScript in emails to automatically compromise accounts on unpatched systems without user interaction. ## Zero-Click Attack Unlike traditional phishing requiring user action, this attack only needs email viewing. The XSS vulnerability CVE-2025-66376 allows embedded malicious code in HTML emails to execute automatically, stealing account credentials without clicks or downloads. ## Attack Mechanism Attackers first send phishing emails from compromised accounts. Hidden Base64-encoded payloads in SVG elements execute via CSS @import directives when viewed in Zimbra webmail. The encrypted payload deploys multi-stage malware for reconnaissance and credential theft. ## Data Collection Methods The malware maintains persistent access by enabling IMAP, creating app passwords, and harvesting 2FA codes. It collects sensitive data including 90 days of emails, contacts, OAuth consumers, and browser-stored passwords from password managers. ## Exfiltration Channels Stolen data is exfiltrated via HTTPS and DNS to attacker-controlled infrastructure called Flowerbed. A dedicated service named Catcher temporarily stores the data. Attackers use deceptive domains mimicking legitimate Zimbra infrastructure for operations. ## Mitigation Measures CISA urges Zimbra users to apply latest security patches. Organizations should review published IOCs, revoke unauthorized app passwords, and implement phishing-resistant MFA. Monitoring for abnormal authentication activity and checking for unauthorized mailbox access is critical. ## Sources covering this story - https://securityaffairs.com/195901/apt/us-agencies-warn-of-laundry-bear-campaign-targeting-unpatched-zimbra-servers.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._