A Zimbra phishing campaign attributed to Russian state-supported cyber actors has targeted Western government and commercial organizations, exploiting CVE-2025-66376 to access sensitive email data and other information, according to a joint cybersecurity advisory issued in July 2026.
The activity has been linked primarily to LAUNDRY BEAR, a Russian state-supported advanced persistent threat (APT) group tracked under several names across the cybersecurity industry. The advisory said the campaign has been active since at least July 2025 and has targeted organizations using the Zimbra Collaboration Suite (ZCS).
Unlike conventional phishing attacks that typically require victims to click a malicious link or open an attachment, the campaign uses a view-based exploit. A user only needs to view a malicious email in a vulnerable version of ZCS webmail for the exploit to attempt execution.
Zimbra Phishing Campaign Uses CVE-2025-66376
The campaign centers on CVE-2025-66376, a vulnerability that was initially exploited as a zero-day vulnerability before a patch was released. According to the advisory, the activity began in July 2025, months before the vulnerability was published and patched.
The vulnerability allows a JavaScript payload contained in email content to execute because of improper sanitization of CSS @import directives within an email. The malicious payload uses Base64 encoding and XOR encryption and can be modified to help bypass basic threat detection signatures.
Once triggered, the payload attempts to collect and exfiltrate information through 12 stages. These include gathering the victim’s email address and environment information, collecting two-factor authentication codes and application passwords, attempting to capture saved passwords, enabling mail protocols, gathering the Global Address List (GAL), and sending archived email data.
The advisory said the campaign’s use of a zero-day exploit demonstrates the ability of LAUNDRY BEAR to operationalize novel vulnerabilities into a successful attack capability.
LAUNDRY BEAR Targets Email and Sensitive Data
The primary objective of the Russian state-supported cyber actors appears to be the covert acquisition of email data. The campaign attempts to steal the last 90 days of email communications, email addresses, passwords, the organization’s Global Address List, 2FA tokens and newly created application passcodes.
The actors have targeted organizations connected to the defense industrial base, government, education, energy, law enforcement, media, non-governmental organizations and technology sectors.
The advisory said LAUNDRY BEAR likely identifies organizations with publicly exposed Zimbra infrastructure through port scanning and commercially available datasets. It may then compile individual user email addresses using commercial data, open-source intelligence or previously exfiltrated information.
The group has also used compromised accounts to distribute phishing emails. Since at least November 2025, malicious emails were reportedly sent from victim infrastructure, potentially using previously compromised accounts to make the activity harder to detect and to bypass anti-phishing measures.
Ulej and Flowerbed Support Email Data Exfiltration
The campaign uses a custom capability called Ulej, which was developed to exploit ZCS and exfiltrate sensitive information. The collected data is sent to infrastructure associated with the Flowerbed framework.
Flowerbed is a Python project using Docker and includes four containers: Catcher, Certbot, Nginx and Gardener. Catcher receives and aggregates stolen information, while Nginx operates as an HTTPS reverse proxy. The framework uses DNS and HTTPS channels for email data exfiltration.
The advisory said the campaign can exfiltrate email content, contacts, attachments, authentication information and other data. The stolen information is initially stored by Catcher before being transferred to non-public-facing infrastructure.
The report also noted indications that artificial intelligence may have played a role in developing the Flowerbed codebase, highlighting the increasing use of AI in developing malicious capabilities.
Organizations Urged to Patch Vulnerable Zimbra Systems
The advisory urged organizations using ZCS to immediately ensure their systems are not running vulnerable versions. A patch for CVE-2025-66376 was released for ZCS versions 10.1.13 and 10.0.18.
If immediate patching is not possible, organizations are advised to have employees use alternative mail clients and avoid the Classic ZCS webmail client until the software is updated.
Security teams are also advised to monitor internet-connected ZCS systems, workstations accessing those systems and network traffic for signs of suspicious activity. Recommended monitoring includes looking for large outbound data transfers to unfamiliar VPS providers, unusual DNS queries with random subdomains, sudden connections to newly established domains and connections involving VPN providers such as Mullvad.
Organizations should also consider authentication services that support passkeys and maintain network monitoring, packet capture or NetFlow data and relevant logs.
The advisory further recommends that organizations identifying victims revoke Application Passcodes and 2FA scratch keys and require affected employees to change their passwords. Security teams should also investigate the original phishing email and quarantine similar messages to prevent further exploitation and data theft.
