/
← Voltar ao feed
high government defense ngo

LAUNDRY BEAR exploits Zimbra CVE-2025-66376 (zero-day since July 2025) to exfiltrate email from Western organizations

1 fonte(s) · 1 atualização(ões) · publicado 21/07/2026 16:08 · coletado há 4 dias

A multinational advisory (CISA, NSA, FBI, AIVD, MIVD, NCSC-UK and others) warns that the Russian state-supported APT LAUNDRY BEAR (aka Void Blizzard, TA488) has compromised Western government, defense industrial base and NGO organizations running Zimbra Collaboration Suite (ZCS) since at least July 2025. The campaign uses a view-based XSS exploit for CVE-2025-66376, which was a zero-day when first exploited and was patched in November 2025. It requires only that a user view a malicious email in a vulnerable ZCS webmail. The custom capability Ulej exfiltrates the last 90 days of email, the Global Address List, 2FA codes and passwords to the actor's Flowerbed collection framework, and tries to set up persistent IMAP access. The activity is assessed as espionage, and the actors are expected to keep targeting ZCS and other email systems.

Detalhes técnicos

  • Initial access: phishing email with a Base64 JavaScript payload in the onload attribute of an SVG element, preceded by CSS @import directives that trigger CVE-2025-66376 (CWE-79). Since at least November 2025 the emails are sent from compromised victim accounts.
  • Obfuscation: the inner payload is XOR-encrypted and Base64-encoded. The actors can change the key or add dummy @import directives to evade signature detection.
  • Collection: 12 asynchronous stages, using ZCS SOAP requests (GetIdentitiesRequest, ModifyPrefsRequest setting zimbraPrefImapEnabled, CreateAppSpecificPasswordRequest with app name "ZimbraWeb", GetScratchCodesRequest, SearchGalRequest brute force). It also harvests saved passwords through hidden password-manager autofill fields and pulls non-junk email via /home/~/?fmt=tgz&meta=0&query=date:-{DAY_OFFSET}d.
  • Exfiltration: over DNS A-record queries and HTTPS to Flowerbed, a Python/Docker framework with Catcher, Certbot, Nginx and Gardener containers. Nginx returns 444 unless the SNI matches *.i.*. The VPS servers are rotated every 7-60 days and accessed via Mullvad VPN.
  • Earlier tradecraft: stolen credentials, an AiTM approach with a modified Evilginx, and session token replay. The Flowerbed code shows signs of AI-assisted development.
  • Targeting: victims are likely identified manually through port-scan and fingerprinting datasets. Ukrainian users were targeted extensively before NATO allies.

Remediação

Patch ZCS to a version that fixes CVE-2025-66376, regularly update mail software, and continuously monitor email systems and emails for malicious activity. The advisory provides IOCs in STIX format (AA26-204A) and specific remediation steps for organizations that find them.

Linha do tempo

  1. cisa.gov ↗ · pub. 21/07/2026 16:08 · coletado 19/10 18:37 primeiro registro

    LAUNDRY BEAR exploits Zimbra CVE-2025-66376 (zero-day since July 2025) to exfiltrate email from Western organizations

    ler a análise desta fonte

    A multinational advisory (CISA, NSA, FBI, AIVD, MIVD, NCSC-UK and others) warns that the Russian state-supported APT LAUNDRY BEAR (aka Void Blizzard, TA488) has compromised Western government, defense industrial base and NGO organizations running Zimbra Collaboration Suite (ZCS) since at least July 2025. The campaign uses a view-based XSS exploit for CVE-2025-66376, which was a zero-day when first exploited and was patched in November 2025. It requires only that a user view a malicious email in a vulnerable ZCS webmail. The custom capability Ulej exfiltrates the last 90 days of email, the Global Address List, 2FA codes and passwords to the actor's Flowerbed collection framework, and tries to set up persistent IMAP access. The activity is assessed as espionage, and the actors are expected to keep targeting ZCS and other email systems.

    Technical Details

    • Initial access: phishing email with a Base64 JavaScript payload in the onload attribute of an SVG element, preceded by CSS @import directives that trigger CVE-2025-66376 (CWE-79). Since at least November 2025 the emails are sent from compromised victim accounts.
    • Obfuscation: the inner payload is XOR-encrypted and Base64-encoded. The actors can change the key or add dummy @import directives to evade signature detection.
    • Collection: 12 asynchronous stages, using ZCS SOAP requests (GetIdentitiesRequest, ModifyPrefsRequest setting zimbraPrefImapEnabled, CreateAppSpecificPasswordRequest with app name "ZimbraWeb", GetScratchCodesRequest, SearchGalRequest brute force). It also harvests saved passwords through hidden password-manager autofill fields and pulls non-junk email via /home/~/?fmt=tgz&meta=0&query=date:-{DAY_OFFSET}d.
    • Exfiltration: over DNS A-record queries and HTTPS to Flowerbed, a Python/Docker framework with Catcher, Certbot, Nginx and Gardener containers. Nginx returns 444 unless the SNI matches *.i.*. The VPS servers are rotated every 7-60 days and accessed via Mullvad VPN.
    • Earlier tradecraft: stolen credentials, an AiTM approach with a modified Evilginx, and session token replay. The Flowerbed code shows signs of AI-assisted development.
    • Targeting: victims are likely identified manually through port-scan and fingerprinting datasets. Ukrainian users were targeted extensively before NATO allies.

    Remediation

    Patch ZCS to a version that fixes CVE-2025-66376, regularly update mail software, and continuously monitor email systems and emails for malicious activity. The advisory provides IOCs in STIX format (AA26-204A) and specific remediation steps for organizations that find them.