IC Technology & Cyber — 2026-07-28

CISA Issues Advisory on Russian Laundry Bear Cyber Campaign Exploiting Zimbra Email Systems

BLUFFormal US attribution of a zero-click Zimbra exploitation chain forces Western organizations still running the platform into an immediate patch-or-migrate decision before secondary actors replicate the technique.

CISA, NSA, FBI, and international partners published joint advisory AA26-204A on July 23, warning that Russian state-sponsored actor Laundry Bear (also tracked as Void Blizzard) has targeted Zimbra Collaboration Suite users through a phishing campaign since at least July 2025 1. BleepingComputer reported the group exploited CVE-2025-66376, a cross-site scripting flaw in Zimbra's Classic UI caused by insufficient sanitization of CSS @import directives, letting malicious code execute automatically when a victim merely views an email rather than clicks a link; Zimbra patched the flaw in November 2025, but unpatched servers remain targeted 2. The exploit harvests a victim's last 90 days of email, address, password, Global Address List, and two-factor authentication tokens, with the victim set spanning government and commercial organizations across Western countries 2. Security Boulevard reported that AttackIQ released ten detection scenarios, one email-based and nine network-based, emulating Laundry Bear's command-and-control and exfiltration traffic to help organizations test defenses against the campaign 3.

Analysis
CISA's AA26-204A formalizes US attribution of the Zimbra intrusion set to Laundry Bear, giving defenders an authoritative baseline to justify emergency patching or migration off the platform, though CISA stands as the sole primary source, with outlet pickup deriving from the advisory rather than independent reporting. AttackIQ's detection scenarios convert the advisory's tactics into testable signatures, shortening the window for organizations to check whether the zero-click exploitation chain already breached their environment, while also telegraphing the technique to other actors with unpatched Zimbra instances still exposed. The disclosure shifts remediation responsibility from user awareness training to server-side patch management, and formal US attribution extends the obligation from Nordic and UK networks, previously flagged by Finnish and NSA reporting, to all federal civilian agencies. The year-long gap between exploitation and disclosure suggests the advisory consolidates a closing case rather than flags an active, unresolved compromise.

3 sources