A Russian state-sponsored threat group, identified as Laundry Bear or Void Blizzard, has been exploiting a cross-site scripting (XSS) vulnerability in the Zimbra web-based email and collaboration suite for at least a year. The attacks, which began in July 2025, allow adversaries to compromise victims simply by viewing a malicious email, without requiring any clicks or file openings.
This campaign targets CVE-2025-66376, an XSS flaw in Zimbra Collaboration Suite (ZCS) that was patched in November 2025. However, Laundry Bear began exploiting the vulnerability months before the patch was released. The attacks involve sending specially crafted HTML email messages that, when viewed, inject malicious JavaScript into the victim's web browser.
The objective of these intrusions is primarily to acquire sensitive information for the Russian Federation, with a focus on covertly obtaining email data. The campaign has targeted a wide range of Western organizations, including those in the defense industrial base, federal and local governments, education, energy, law enforcement, media, non-governmental organizations, and technology sectors.
Upon successful exploitation, the attackers exfiltrate a significant amount of data. This includes the victim's email communications from the last 90 days, email addresses and passwords, organizational email directories such as global address lists, two-factor authentication tokens, and newly generated application passcodes. The stolen credentials are then used to maintain persistent access to the victims' email, allowing the attackers to modify account preferences and continue collecting authentication information.
The stolen data is stored on an unattributable virtual private server (VPS) utilizing a custom collection framework named "Flowerbed." This framework is described as a Python project that leverages Docker for containerization. Analysis of the Flowerbed codebase suggests that artificial intelligence may have played a role in its development due to its simplistic nature.
Several email addresses have been identified as being used in this campaign, including ivanka.zurabishvili@proton[.]me, zmul1@buildandconsulting[.]com, garrysmithme@pinmx[.]net, and hostingclient@pinmx[.]net.
A joint security alert issued by 27 US, UK, and other international government agencies attributes these intrusions to Laundry Bear/Void Blizzard. The alert, spanning 31 pages, includes an extensive section detailing indicators of compromise (IOCs) to help organizations identify compromised individuals and systems.
Organizations are strongly advised to review these IOCs and to minimize employees' use of the ZCS webmail client until they have updated to a patched version that is no longer vulnerable to CVE-2025-66376.
