# Russia's new cyberattack: Just viewing an email is enough Zimbra vulnerability exploited in attacks that steal data without requiring clicks. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-07-23 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/667c3fca-7515-44ef-8ad4-98f805602765 ## No click needed Russia-linked group Laundry Bear developed a novel cyberattack method exploiting a Zimbra email system vulnerability. Merely viewing the email triggers malicious code execution, making it far more dangerous than traditional phishing attacks that require user interaction. ## Broad targeting The campaign has targeted defense, energy, education, media and government sectors since July 2025. A joint report from 27 international agencies indicates stolen data is being used for Russian intelligence purposes in this ongoing operation. ## Attack mechanism Attackers inject malicious JavaScript into HTML emails using CVE-2025-66376 vulnerability in Zimbra Collaboration Suite. When viewed, their custom Flowerbed framework steals 90 days of email traffic, passwords, and two-factor authentication details without any user interaction. ## AI-assisted tool The Python-based Flowerbed framework shows signs of AI-assisted development. Using Docker containers, attackers exfiltrate data to untraceable servers through this sophisticated collection system that automates credential harvesting. ## Protection measures Experts recommend minimizing Zimbra webmail client use until systems are patched. The 31-page security advisory contains detailed Indicators of Compromise (IOCs) for organizations to check potential breaches in this widespread campaign. ## Cybersecurity wake-up call These attacks demonstrate the fragility of critical infrastructure cybersecurity. Enhanced security collaboration between governments and enterprises emerges as the most effective defense against similarly sophisticated state-sponsored operations. ## Sources covering this story - https://www.theregister.com/patches/2026/07/23/year-long-russian-attacks-infect-users-as-soon-as-they-look-at-an-email/5277358 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._