IC Technology & Cyber — 2026-07-23

CISA, NSA, FBI and 16 Allied Agencies Warn Russian Laundry Bear Group Exploiting Zimbra Zero-Day to Steal Western Government Data

BLUFLAUNDRY BEAR will likely retool its zero-click collection capability against an alternative collaboration platform within 90 days, as the advisory's public indicators accelerate the group's established pattern of pivoting after exposure.

CISA, NSA, FBI and 16 partner agencies from 15 allied nations issued a joint advisory Thursday attributing a year-long espionage campaign against Zimbra Collaboration Suite users to the Russian state-supported group LAUNDRY BEAR, also tracked as Void Blizzard 12. The advisory states the group has exploited CVE-2025-66376, a zero-day patched in November 2025, since at least July 2025, using a view-based exploit requiring no user interaction beyond opening an email 13. The exploit, delivered via a custom capability the advisory names "Ulej," attempts to exfiltrate 90 days of email, the organization's Global Address List, search history, account passwords, newly created passwords and two-factor authentication tokens to actor-controlled infrastructure 13. Targeted sectors include defense, government, education, energy, law enforcement, media and technology across the United States and allied countries, with Ukrainian networks targeted first, according to the advisory 13. Officials said unpatched ZCS instances remain under active exploitation and did not name specific victim organizations or estimate the number compromised 3.

Analysis
The advisory converts LAUNDRY BEAR's exploit mechanics and indicators of compromise into a public record, placing every unpatched Zimbra Collaboration Suite instance on a known-target list for both defenders and the actor. The group will likely adapt its Ulej exfiltration capability to target an alternative webmail or collaboration platform within the next 90 days, given its documented pattern of retooling from Ukrainian networks to NATO targets after prior exposure. Moderate confidence reflects strong precedent for Russian APT platform-pivoting after advisory publication, offset by the absence of specific indicators pointing to a successor target. The zero-click delivery method, requiring no user interaction beyond opening a crafted email, is the tactically distinctive element: it eliminates the phishing-awareness layer that organizations rely on as a last defense.
4 sources
  1. Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite - CISA
  2. NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phishing Campaign - National Security Agency
  3. Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries - CyberScoop
  4. Russian Hackers Exploit New Zero-Click Attack - Infosecurity Magazine

View in full brief →

UNCLASSIFIED // OPEN SOURCE