TL;DR

• A Russian state-sponsored actor (tracked by Unit 42 as CL-STA-1114, by the Dutch AIVD/MIVD and joint international advisory as "Laundry Bear," and overlapping with Microsoft's Void Blizzard) has been exploiting a Zimbra Collaboration Suite zero-day (CVE-2025-66376) since at least July 2025. The exploit is a "half-click"/zero-click stored XSS: simply opening or previewing a crafted HTML email in a vulnerable Zimbra Classic UI webmail session is enough to trigger silent JavaScript execution and full mailbox compromise: no attachment, no link click, no macro.
• The campaign is far larger than the single incident that first surfaced it. Seqrite Labs publicly documented one narrow slice in March 2026 (a Ukrainian State Hydrology Agency target, which it named "Operation GhostMail" and attributed with medium confidence to APT28/Fancy Bear). A July 2026 joint advisory from CISA and 14 other countries' agencies, corroborated by Unit 42 and Proofpoint, revealed the activity dates back a full year earlier and hit government, defense, transportation, and financial-sector targets across NATO member states, Ukraine, CIS countries, and Africa.
• The payload is a nine-operation browser-resident stealer, not a dropped binary. Once triggered, it inherits the victim's live Zimbra session (cookies, CSRF token, SOAP API rights) and, using Promise.all to run everything in parallel before the tab closes, steals credentials, session tokens, backup 2FA codes, mints a persistent app-specific password, silently enables IMAP, enumerates OAuth grants and mobile devices, harvests browser-autofilled passwords, and exfiltrates 90 days of mail via dual DNS/HTTPS channels. There is no malware to hash; network and SOAP-API telemetry are the durable detection surface.

Executive Summary

On July 23-24, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA), joined by cybersecurity and intelligence agencies from more than a dozen allied nations, published a joint advisory describing sustained Russian state-sponsored exploitation of Zimbra Collaboration Suite (ZCS) webmail. The advisory attributes the activity to an actor the Dutch General Intelligence and Security Service (AIVD) named "Laundry Bear," a group the agency first identified in May 2025 as adjacent to, but distinct from, other well-known Russian APT clusters. Unit 42 tracks the same activity as CL-STA-1114 and notes it overlaps with Microsoft's "Void Blizzard" designation.

What makes this campaign distinctive is not the target set (Russian intrusion sets have hit Ukrainian and Western government targets via webmail platforms for years) but the exploit mechanics. Prior Zimbra-focused campaigns (APT29's server-side command-injection credential theft, TA473/Winter Vivern's lighter JavaScript stealers) required either a vulnerable server configuration or some form of user interaction with a malicious link or attachment. Laundry Bear's exploit for CVE-2025-66376 requires neither: it is a "half-click," view-based exploit. If a targeted user simply opens or previews the email in a vulnerable Zimbra Classic UI session, the browser silently executes attacker JavaScript with the full privileges of that session.

The vulnerability was quietly patched by Zimbra in ZCS 10.0.18 / 10.1.13 in November 2025, described in release notes only as a "stored XSS vulnerability in the Classic UI where attackers could abuse CSS @import directives in email HTML," with no CVE identifier assigned until early January 2026, and no public advisory alerting Zimbra customers to the severity or exploitation until Seqrite's March 2026 report and CISA's KEV catalog addition the following day. That gap between silent patch and public disclosure appears to have given Laundry Bear months of continued exploitation against unpatched or unaware Zimbra deployments.

Proofpoint (tracking the actor as TA488) assesses the group appears to have wound down this specific exploit chain around February 2026, shortly after Seqrite's public detection, but cautions it continues to observe "other unclustered activity sets" exploiting the same flaw in the wild, and warns the group may be using large language models to develop a patch bypass to resume operations.

Threat Actor Profile

Laundry Bear / Void Blizzard / CL-STA-1114 is assessed as a Russian state-sponsored espionage actor. Key attribution points, per the joint advisory and Unit 42:

• First identified: May 2025, by the Netherlands' AIVD, as a new actor adjacent to (but distinct from) other established Russian APT clusters.
• Tracking names: Laundry Bear (AIVD/MIVD, joint advisory), Void Blizzard (Microsoft), CL-STA-1114 (Unit 42), TA488 (Proofpoint).
• Objective: Assessed "almost certainly" to gather sensitive information for the Russian Federation: classic cyberespionage rather than financially motivated activity.
• Prior tradecraft: Before adopting the Zimbra exploit, the group relied on unsophisticated techniques: password spraying and conventional (click-required) phishing.
• Targeted sectors and regions (per Unit 42/CL-STA-1114): Governments, defense, transportation, and financial organizations across NATO member states, Ukraine, Commonwealth of Independent States (CIS) countries, and Africa.
• Operational span: Active against Zimbra targets since at least July 2025, a full year prior to the joint advisory's publication, and roughly five months before Seqrite's public detection of the narrower "Operation GhostMail" slice of this activity.
• Exploit provenance: Proofpoint assesses the CVE-2025-66376 exploit was likely supplied to the group by Russian intelligence services rather than developed independently; Laundry Bear's historical tradecraft did not show the sophistication this exploit chain requires.

A Note on Attribution Overlap: Operation GhostMail vs. Laundry Bear

Seqrite Labs' March 2026 report on "Operation GhostMail" documented a single, narrowly targeted incident: a phishing email sent January 22, 2026 to Ukraine's State Hydrology Agency (operating under the Ministry of Infrastructure, responsible for navigational/maritime/hydrographic support, critical national infrastructure). Seqrite attributed that specific intrusion to APT28/Fancy Bear with medium confidence, based on payload-structure overlap with ESET's previously documented "Operation RoundPress" SpyPress.ZIMBRA malware family.

The July 2026 joint advisory and Unit 42's CL-STA-1114 research describe a substantially broader campaign using the same CVE and near-identical JavaScript stealer architecture, but track it as a distinct actor (Laundry Bear/Void Blizzard) rather than APT28. Both attributions point to Russian state sponsorship, and it is plausible that Operation GhostMail represents one victim within the larger Laundry Bear campaign, or that the exploit/tooling was shared across operators; Proofpoint's assessment that the exploit was "gifted" by Russian intelligence rather than independently developed supports either reading. Treat "Operation GhostMail" and "Laundry Bear" as overlapping-but-not-confirmed-identical clusters until further infrastructure or code-level correlation is published.

Vulnerability: CVE-2025-66376

CVE-2025-66376 is a stored cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite Classic UI, caused by insufficient sanitization of HTML content, specifically crafted tag structures and attribute values containing a CSS @import directive alongside other script-injection vectors. Per the CVE description, the vulnerability triggers when a user views a crafted email message in the Classic UI.

• Patched: ZCS 10.0.18 / 10.1.13, November 2025 (disclosed only as a generic "stored XSS" bug in release notes; no CVE assigned publicly until early January 2026).
• CVSS: 7.2 (High).
• KEV status: Added to CISA's Known Exploited Vulnerabilities catalog March 18, 2026, the day after Seqrite's public report.
• Exploitation window observed: At least July 2025 through approximately February 2026 for this specific campaign (Proofpoint); unpatched instances remain at risk from unrelated actors reusing the same flaw.

Zimbra and parent company Synacor did not respond to press inquiries about the delayed disclosure timeline.

Attack Chain

Stage 1: Delivery and the "Half-Click" Trigger

The attack begins with a phishing email (either an HTML attachment or HTML embedded directly in the message body) crafted to look innocuous. In the Seqrite-documented GhostMail incident, the lure was a routine internship inquiry, written in Ukrainian, purportedly from a fourth-year student at Ukraine's National Academy of Internal Affairs (the sending mailbox was itself likely compromised, based on header analysis). In the broader CL-STA-1114 activity Unit 42 observed, lures were instead styled as news-digest content ("Global News Digest: Business, Economics & Eurasia") designed to catch the recipient's attention.

Concealed inside the HTML (in the GhostMail sample, inside a <div style="display:none"> block) is a large Base64-encoded JavaScript payload. The exploit uses a tag-name bypass technique: @import tokens are stripped from inside tag names and attribute key/value strings, alongside decoy broken <script>/<style> tags and an HTML comment inserted mid-tag-name. This causes the webmail client's HTML sanitizer (AntiSamy, in Zimbra's case) to reconstruct a functional <svg onload=eval(atob(...))> payload from the fragmented tokens, bypassing regex-based inspection while remaining valid to a browser's actual HTML parser.

Critically, no click is required. Viewing or previewing the email in a vulnerable Zimbra Classic UI session is sufficient to trigger execution.

Stage 2: JavaScript Loader

The reconstructed payload is a self-executing function. It first checks for a marker ID (zmb_pl_v3_ in the GhostMail sample) to prevent double-injection, then decodes the outer Base64 layer with atob() and XORs it against a hardcoded key to recover the final-stage JavaScript. The decoded code is injected into the top-level document, escaping any webmail iframe sandbox and inheriting the full session context: cookies, localStorage, and same-origin SOAP API rights.

Stage 3: Browser-Resident Stealer

The final payload executes entirely in browser memory; nothing is written to disk. On each execution it generates a random 12-character session token to identify the victim across all subsequent C2 requests, then launches up to nine operations in parallel via Promise.all, maximizing data yield in the roughly 10-second window before a victim might close the tab:

1. SendStartPing: notifies the C2 that execution has begun, letting the operator correlate session timing.
2. gather_email: scrapes the batchInfoResponse variable Zimbra embeds on page load, falling back to a GetIdentitiesRequest SOAP call for all configured identities and aliases.
3. gather_environment: calls GetInfoRequest to dump full server configuration (Zimbra version, account quota, enabled features, server hostname, account preferences) as a JSON blob.
4. gather_2fa_codes: calls GetScratchCodesRequest to steal the account's backup 2FA recovery codes, enabling authentication even after a password reset.
5. gather_app_password: calls CreateAppSpecificPasswordRequest to mint a new, persistently valid credential (observed named ZimbraWeb). This is the long-term access mechanism: it survives password resets and enables direct IMAP/API authentication indefinitely.
6. gather_device_status: calls GetDeviceStatusRequest to enumerate all ActiveSync-connected mobile devices.
7. gather_oauth_consumers: calls GetOAuthConsumersRequest to list every third-party OAuth application authorized on the account, revealing what other platforms and API-level access the victim has granted.
8. gather_autocomplete_password: injects two hidden, off-screen form fields (autocomplete="username"/"current-password") and waits five seconds for the browser's own password manager to autofill them, then reads and exfiltrates whatever appeared. This is the only operation that does not require a stolen CSRF token, since it targets the browser rather than Zimbra's API.
9. enable_mail_protocols: calls ModifyPrefsRequest to silently set zimbraPrefImapEnabled: TRUE, enabling IMAP access that the minted app-specific password can then use for ongoing mailbox surveillance from any IMAP client.

Every SOAP call is wrapped to return null on failure rather than throw, so one blocked operation doesn't abort the rest. Every exception, anywhere in the payload, triggers a POST to /v/p reporting the failing stage, error message, and stack trace back to the operator, giving Laundry Bear real-time debugging visibility into exactly which step failed on which victim.

Stage 4: Bulk Mailbox Exfiltration

The highest-impact operation, sendArchives, loops through the previous 90 days, downloading each day's non-junk mail from Zimbra's built-in export endpoint (/home/~/?fmt=tgz) and uploading each archive directly to a per-victim subdomain (js-[token].i.<C2 domain>/v/d). Two upload modes are implemented depending on browser capability: a streaming ReadableStream pipe for modern browsers, or a buffered array (capped at 500 MB) for older ones. Progress checkpoints are stored in localStorage (zd_comp_YYYY-MM-DD keys) so that if the tab is reopened, already-exfiltrated days are skipped and the operation resumes.

Stage 5: Exfiltration Channel

Two independent exfiltration channels run throughout: small structured values (session tokens, individual 2FA codes, error reports) are sent via Base32-encoded DNS queries, segmented into 60-character chunks forming hostnames of the pattern d-<token>.<key>.<base32_chunk>.i.<C2 domain>, ensuring data can egress even where outbound HTTPS is blocked; larger structured objects (server config dumps, mail archives) go via HTTPS POST to /v/d, with smaller beacon-style updates via POST to /v/p. A final sendFinishPing beacon confirms all operations completed, letting the operator measure total session duration and infer what was likely captured.

Timeline

Indicators of Compromise

Network: IP Addresses

Network: Domains

Host Artifacts / Application-Layer

MITRE ATT&CK Mapping

Key Takeaways

Zero-click is not hyperbole here. Most "sophisticated phishing" reporting still assumes a click, an attachment open, or a macro grant somewhere in the chain. This campaign requires none of that: previewing an email in a vulnerable session is enough. User training cannot mitigate this; patching and session/API-level monitoring are the only real controls.

Silent patching created the exposure window. Zimbra fixed the underlying bug in November 2025 but described it generically and did not secure a CVE identifier or public advisory until roughly two months later. Organizations tracking "patched" status by changelog review rather than CVE feeds would have had no signal to prioritize this update, and Laundry Bear had a multi-month head start as a result.

The malware-free design defeats file-based detection entirely. There is no binary to hash, no process to flag, no file to sandbox. This is a browser session compromise, full stop. Detection has to live at the network layer (domains, IPs, DNS patterns) and the SOAP API layer (anomalous GetScratchCodesRequest/CreateAppSpecificPasswordRequest calls), not the endpoint.

Persistence survives the obvious remediation. A minted app-specific password and silently enabled IMAP both survive a password reset. If your incident response playbook for a compromised Zimbra account stops at "reset password," this campaign demonstrates exactly why that is insufficient: app-specific passwords and protocol settings must be explicitly audited and revoked.

Attribution is still settling. Whether "Operation GhostMail" (APT28, medium confidence) and "Laundry Bear" (Void Blizzard/CL-STA-1114) represent the same operator, shared tooling across operators, or genuinely separate clusters using intelligence-supplied exploits is not yet resolved publicly. Treat both names as referring to the same threat model and IOC set for defensive purposes regardless of how attribution eventually shakes out.

References

1. Unit 42. (2026, July 23). Russian Global Webmail Espionage. Palo Alto Networks. https://unit42.paloaltonetworks.com/russian-webmail-espionage/

2. Wright, R. (2026, July 23). Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets. Dark Reading. https://www.darkreading.com/cyberattacks-data-breaches/russian-hackers-zimbra-zero-day-us-ukraine-targets

3. Prakki, S. R., & Jivani, K. (2026, March 17). Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. Seqrite Labs. https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/

4. Cyber.gov.au / Australian Cyber Security Centre. (2026, July). Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite. https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite

5. CISA. (2026, July 23). Joint Cybersecurity Advisory AA26-204A: Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a

6. Proofpoint. (2026, July 23). TA488 Targets Zimbra Mailservers With Half-Click Exploits. https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits

7. AIVD / MIVD. (2025, May 27). Advisory: AIVD and MIVD Identify New Russian Cyber Actor. https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf

8. Microsoft. (2025, May 27). New Russia-Affiliated Actor Void Blizzard Targets Critical Sectors for Espionage. https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/

9. NIST National Vulnerability Database. (2026). CVE-2025-66376. https://nvd.nist.gov/vuln/detail/CVE-2025-66376

10. ESET / WeLiveSecurity. (2024). Operation RoundPress. https://www.welivesecurity.com/en/eset-research/operation-roundpress/ (referenced by Seqrite for SpyPress.ZIMBRA payload-structure comparison)

11. Internal: 2026-07-24 Morning Threat Intelligence Brief, Daily Briefs folder.