Russia's new cyberattack: Just viewing an email is enough
Zimbra vulnerability exploited in attacks that steal data without requiring clicks.
1No click needed
Russia-linked group Laundry Bear developed a novel cyberattack method exploiting a Zimbra email system vulnerability. Merely viewing the email triggers malicious code execution, making it far more dangerous than traditional phishing attacks that require user interaction.
2Broad targeting
The campaign has targeted defense, energy, education, media and government sectors since July 2025. A joint report from 27 international agencies indicates stolen data is being used for Russian intelligence purposes in this ongoing operation.
3Attack mechanism
Attackers inject malicious JavaScript into HTML emails using CVE-2025-66376 vulnerability in Zimbra Collaboration Suite. When viewed, their custom Flowerbed framework steals 90 days of email traffic, passwords, and two-factor authentication details without any user interaction.
4AI-assisted tool
The Python-based Flowerbed framework shows signs of AI-assisted development. Using Docker containers, attackers exfiltrate data to untraceable servers through this sophisticated collection system that automates credential harvesting.
5Protection measures
Experts recommend minimizing Zimbra webmail client use until systems are patched. The 31-page security advisory contains detailed Indicators of Compromise (IOCs) for organizations to check potential breaches in this widespread campaign.
6Cybersecurity wake-up call
These attacks demonstrate the fragility of critical infrastructure cybersecurity. Enhanced security collaboration between governments and enterprises emerges as the most effective defense against similarly sophisticated state-sponsored operations.