Russian Hackers Are Reading Your Email Just by Sending You One: Zimbra Zero-Day Explained

Key points

• A Russian state-backed hacking group known as LAUNDRY BEAR has been breaking into Western government and corporate email since at least July 2025 by exploiting a flaw in Zimbra Collaboration Suite, a popular business email platform.
• The bug CVE-2025-66376 was a zero-day when attacks began and was patched by Zimbra in November 2025.
• The exploit fires when a target views a malicious email in the webmail window. No click required.
• Once triggered, it steals the victim's last 90 days of email, the company address book, and session data, then tries to hold a foothold in the account.
• The warning comes from a joint advisory led by the NSA, FBI, CISA, and Dutch intelligence services AIVD and MIVD, co-signed by more than 20 agencies across Europe and the Five Eyes.

A Russian intelligence-linked hacking crew has spent the second half of 2025 quietly siphoning email out of Western governments and companies by abusing a previously unknown flaw in Zimbra webmail.

The group's primary name is LAUNDRY BEAR, coined by Dutch military and civilian intelligence. Microsoft tracks the same crew as Void Blizzard. Palo Alto uses CL-STA-1114. Proofpoint uses TA488.

The vulnerability at the centre of the campaign is CVE-2025-66376, a bug in Zimbra Collaboration Suite (ZCS), the webmail and calendar platform used by government agencies and businesses that run their own mail servers. Zimbra shipped a fix in November 2025. Attacks began in July 2025 or earlier, according to the joint advisory.

What does the attack actually do?

It reads your inbox without you clicking anything. Malicious code sits inside an email and runs the instant the victim opens it in a vulnerable Zimbra webmail tab.

That's unusual. Most phishing, where criminals send fake emails to trick staff into handing over passwords or opening booby-trapped files, needs a click on a link or an attachment. This one doesn't. Security researchers call this a view-based exploit: looking at the email is enough.

Once it runs, the code copies the victim's last 90 days of email, the organisation's internal address book (called the Global Address List), and other account data, then ships it to servers the hackers control. It also plants ways to get back in later, so the intrusion survives a password reset.

Who is behind it, and what do they want?

The authoring agencies say LAUNDRY BEAR works on behalf of the Russian Federation and focuses on stealing email for intelligence purposes. Earlier campaigns, first flagged by AIVD, MIVD, and Microsoft in May 2025, targeted cloud-based email environments using stolen credentials bought on criminal markets and a fake European Defence and Security Summit sign-in page.

That earlier work was crude: password spraying, cookie theft, adversary-in-the-middle phishing kits. The Zimbra campaign is a step up. It pairs a custom tool the group calls "Ulej" (Russian for beehive) with a real zero-day, meaning a flaw the vendor didn't know about when attacks started. We covered Zimbra's broader November patch cycle two days before this advisory landed, and that story noted no confirmed exploitation at the time. This advisory closes that gap.

What versions are affected and what should defenders do?

Patch Zimbra now, hunt for signs the bug was already used against you, and rotate credentials for any account that logged into a vulnerable server. The advisory ships indicator files in STIX format for threat hunters.

Should ordinary users worry?

If your employer runs Zimbra and hasn't patched, assume email from the past three months could have been read. Watch for password reset emails you didn't request and suspicious replies to old threads. Change your password from a device you trust and turn on multi-factor authentication if it isn't already on.

LAUNDRY BEAR isn't going away. The advisory says the group will keep hunting for new email bugs and will fall back on social engineering, meaning manipulation of staff, when the technical route closes. The real story here isn't the exploit mechanics; it's that a state-backed crew moved from bulk credential theft to a bespoke zero-day inside a single year. That's a capability jump worth watching.