Western cybersecurity agencies have issued a joint alert regarding a new "zero-click" attack campaign attributed to Russian state-supported hackers. The campaign, active since at least July 2025, targets government and commercial organizations in Western nations, exploiting a vulnerability in the Zimbra Collaboration Suite (ZCS) software to gain persistent network access and steal sensitive data.
The advisory, released on July 23, attributes the attacks to a cyber espionage operation known as Laundry Bear, also identified as Void Blizzard and UAC-0190. This group is exploiting a zero-day vulnerability in ZCS, tracked as CVE-2025-66376, which was publicly disclosed in November 2025. The exploit, dubbed "beehive," is designed to steal emails and other confidential information.
Unlike traditional phishing, which relies on user interaction like clicking a link, the Laundry Bear campaign leverages a view-based exploit. This means a user only needs to view a malicious email within a vulnerable version of the ZCS webmail service for the exploit to succeed. Upon successful compromise, attackers aim to exfiltrate at least the last 90 days of emails from the server, alongside other sensitive data.
To maintain persistence on compromised networks, Laundry Bear attempts to steal passwords and bypass multi-factor authentication (MFA) protections by acquiring session tokens. The targeted sectors include defense, government, education, energy, law enforcement, media, non-governmental organizations (NGOs), and technology.
The joint advisory was issued by a coalition of cyber intelligence agencies, including the UK National Cyber Security Centre (NCSC), US agencies such as the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and the FBI. Other contributing agencies are from the Five Eyes nations (Canada, Australia, and New Zealand), as well as various European agencies.
Organizations utilizing ZCS are strongly urged to immediately patch the critical vulnerabilities and enhance their network monitoring capabilities. The NCSC also highlighted that this campaign demonstrates how threat actors adapt techniques to exploit vulnerable technology for espionage.
Beyond patching, system administrators should actively monitor for suspicious activity. The advisory also recommends considering the use of a third-party authentication service that supports passkeys for ZCS and other services lacking native passkey support. This measure can help mitigate the risk of attackers exploiting stolen credentials to access servers.
A technical analysis of the campaign suggests that artificial intelligence played a role in developing a simple codebase for the operation. This observation aligns with previous warnings from intelligence agencies about the potential for malicious actors to leverage AI in their cyber campaigns.
