Allied Intelligence — 2026-07-26

Finnish Supo and NSA Issue Joint Advisory Warning of Russian Laundry Bear Cyber Espionage Campaign Targeting NATO Email Systems

BLUFLaundry Bear's zero-click Zimbra vector converts every unpatched NATO mail server into a persistent Russian collection platform, and eight months of available patching has not closed the exposure.

The NSA, UK National Cyber Security Centre, Finland's SUPO and Defence Intelligence, and partner agencies across the U.S., Europe, Australia and New Zealand issued a joint advisory on Laundry Bear, a Russian state-sponsored group running a zero-click phishing campaign against organizational email systems 123. SUPO identified victims across military industry, public administration, technology firms and third-sector operators, concentrated in NATO member states and Ukraine, with Finland also targeted 2. The group has exploited CVE-2025-66376, a zero-day in the Zimbra Collaboration Suite patched in November 2025, embedding a JavaScript payload known as Ulej, Russian for "beehive," in emails from compromised accounts that executes automatically when opened and harvests mailbox data 13. The Record reported that the advisory describes Laundry Bear attempting to exfiltrate up to 90 days of stored email, passwords, contact lists and two-factor authentication codes from compromised accounts 3.

Analysis
The advisory shifts burden onto email administrators rather than network engineers, since Zimbra operators must confirm patching or migrate even though CVE-2025-66376 was fixed in November. Ninety-day mail, credential and two-factor-code exfiltration turns any lagging instance into a persistent espionage foothold rather than a single breach, and Supo's assessment that exploitation potential persists despite the patch means the vector stays live wherever remediation lags. Sequencing through Ukrainian targets before NATO and U.S. organizations, corroborated by Unit 42 and Proofpoint, points to Ukrainian networks serving as a tradecraft proving ground before westward deployment, though overlapping tactics with Fancy Bear suggest shared Russian tooling across units rather than a genuinely distinct actor. Reporting traces to a single joint advisory across sixteen agencies, with Supo and The Record supplying localization and amplification rather than independent corroboration.

4 sources

UK and partners expose Russian state-supported actors for new 'zero-click' phishing campaign targeting Western organisations - UK National Cyber Security Centre
SUPO and the FDI warn companies of Russian cyber threat actor Laundry Bear - Supo
International alert spotlights Russia-linked attacks on Zimbra webmail - The Record from Recorded Future News
Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite - CISA/NSA/FBI (joint Cybersecurity Advisory AA26-204A, co-signed by 16 national agencies)