A Russian state-sponsored threat group has been exploiting a zero-day vulnerability in Zimbra Collaboration Suite since July 2025, stealing sensitive data from governments and commercial organizations across multiple Western countries. The vulnerability, identified as CVE-2025-66376, was not patched until November 2025, five months after the attacks began. The group, known as Laundry Bear or Void Blizzard, is still actively exploiting unpatched Zimbra instances.
The exploit, which requires no user interaction beyond viewing a malicious email, allows attackers to steal up to 90 days of email content, account passwords, search history, organizational email directories, two-factor authentication tokens, and newly created passwords. This persistent and covert activity, without any known financial extortion, strongly suggests an espionage motivation backed by the Russian government.
The campaign has targeted governments and organizations in the defense, education, energy, law enforcement, media, finance, transportation, and technology sectors. Prior to its use against the U.S. and other NATO allies, the exploit was extensively deployed against Ukrainian targets, indicating a trend among Russian cyber threat groups to use Ukraine as a testing ground for malicious techniques before broader global deployment.
Laundry Bear's year-long campaign demonstrates advanced technical capabilities, including the use of a custom JavaScript payload delivered via phishing emails. The group has also developed a novel data exfiltration and aggregation capability, dubbed "beehive," which officials warn could be adapted to exploit other vulnerabilities.
The medium-severity rating of 6.1 for CVE-2025-66376 highlights the challenges organizations face in prioritizing patching schedules based solely on severity metrics. The Russian state-supported group, active since at least 2024, is believed to manually identify and target victim organizations by scanning for public-facing infrastructure. Once a target is identified, the group likely compiles email addresses for phishing campaigns.
U.S. authorities and cyber officials from 15 other countries, including Australia, Canada, New Zealand, the United Kingdom, Czech Republic, Denmark, Estonia, Finland, France, Italy, Moldova, the Netherlands, Poland, Spain, and Sweden, issued a joint cybersecurity advisory. The advisory includes indicators of compromise and mitigation steps, urging organizations to update their vulnerable software immediately. Specific victims or the total volume of compromised organizations have not been disclosed.
