Laundry Bear, a Russian state-sponsored hacking group, targeted organizations using Zimbra Collaboration Suite by exploiting CVE-2025-66376, a zero-click cross-site scripting vulnerability in the Classic UI. This vulnerability allowed embedded JavaScript in crafted HTML emails to execute automatically upon viewing, enabling attackers to steal account data including emails from the last 90 days, email addresses, passwords, Global Address List, and two-factor authentication tokens. The attackers also generated Zimbra application passcodes to maintain access via legacy clients, bypassing MFA protections. Data exfiltration occurred over DNS and HTTPS to attacker-controlled servers running the 'Flowerbed' framework. Additionally, Laundry Bear used adversary-in-the-middle phishing kits impersonating Zimbra login portals to harvest credentials and session cookies. The vulnerability was actively exploited before being patched in November 2025. CISA recommends updating Zimbra to the latest version, reviewing IOCs, investigating suspicious connections and authentication activity, revoking unauthorized application passcodes, and implementing phishing-resistant MFA.

Successful exploitation allows attackers to steal extensive email data, credentials, and two-factor authentication tokens without requiring user interaction, enabling persistent unauthorized access to email accounts. The attackers can bypass multi-factor authentication by creating application passcodes for legacy clients. This compromises confidentiality and integrity of email communications and potentially broader organizational security. The vulnerability was actively exploited in the wild by a sophisticated state-sponsored group targeting government, defense, law enforcement, energy, media, education, and NGO sectors.

Zimbra patched the vulnerability in November 2025. Organizations should update to the latest Zimbra version to apply all security updates. CISA recommends reviewing published indicators of compromise, investigating systems for connections to identified malicious domains and IPs, monitoring for suspicious authentication activity, revoking unauthorized application passcodes (especially those labeled 'ZimbraWeb'), and reviewing accounts for unauthorized mailbox access. Implement phishing-resistant multi-factor authentication where possible. These steps address both the vulnerability exploitation and associated phishing campaigns.