A joint advisory from the UK National Cyber Security Centre and allied cyber agencies published yesterday has formally attributed an ongoing email collection campaign to LAUNDRY BEAR, a Russian state-supported advanced persistent threat group. The campaign exploits CVE-2025-66376, a cross-site scripting flaw in Zimbra Collaboration Suite, to harvest email content without requiring any interaction from victims. Advisory reference: AA26-204A.
How the Attack Works
CVE-2025-66376 is a stored XSS vulnerability arising from insufficient sanitisation of CSS @import directives in Zimbra’s email parsing pipeline. An attacker sends a specially crafted email to the target. When that email is previewed or opened in the Zimbra webmail interface, the injected script executes within the context of the victim’s authenticated session — no click, no attachment, no further action required.
LAUNDRY BEAR operators deploy a custom tooling suite referred to in the advisory as “Ulej.” Once triggered, Ulej systematically extracts up to 90 days of historical email content from the compromised mailbox, harvests entries from the Global Address List, and captures authentication tokens. The tool is designed for quiet, sustained collection rather than noisy one-time exfiltration, reflecting intelligence-gathering priorities rather than disruptive intent.
The advisory notes the campaign has been active since at least July 2025. Full scope of compromise across affected organisations remains under investigation.
Attribution and Targeting
The NCSC, CISA, NSA, and twelve additional allied agencies have attributed the campaign to LAUNDRY BEAR with sufficient confidence to publish a named joint advisory. No specific unit designation (GRU, FSB, SVR) is named in public materials, though the targeting profile is consistent with broad foreign intelligence collection.
The scope is broader than typical narrowly-targeted espionage. Confirmed sector targeting spans defence, government, education, energy, law enforcement, media, technology, and non-governmental organisations. LAUNDRY BEAR appears to be running a systematic collection programme against any organisation of potential intelligence value that is still operating an unpatched Zimbra deployment.
Implications for Affected Sectors
The zero-click exploitation is the critical operational factor. It renders standard user awareness training, phishing simulation programmes, and email security gateways ineffective as primary defences against this specific campaign. An unpatched Zimbra instance is vulnerable regardless of staff behaviour.
For organisations in energy, communications, and critical national infrastructure: the primary risk is sustained, silent intelligence collection. Harvested email content covering 90 days of correspondence — strategic plans, personnel communications, third-party relationships, negotiation details — represents material that could enable follow-on operations including targeted social engineering, insider threat development, or compromise of third parties identified in collected correspondence.
Organisations should not assume they are outside targeting scope. The breadth of sectors named in the advisory is notable, and LAUNDRY BEAR appears to be operating opportunistically against any vulnerable Zimbra deployment within its areas of interest.
Recommended Actions
Patch Zimbra Collaboration Suite to the current release immediately. CVE-2025-66376 is addressed in current Zimbra releases. This patch should be treated as a priority and should not wait for a standard maintenance window.
Audit Zimbra access logs for the past 90 days for indicators of Ulej-style activity: bulk API access patterns, repeated mailbox reads outside normal working hours, access from unfamiliar IP ranges, or unusual Global Address List queries. Enable multi-factor authentication on Zimbra where not already configured. Restrict external Zimbra webmail access to VPN or known IP ranges where operationally feasible.
If your organisation has been operating an unpatched Zimbra instance, treat email content from the past 90 days as potentially compromised and assess what secondary risk that creates. The full advisory AA26-204A contains indicators of compromise and additional technical guidance.