Summary
- LAUNDRY BEAR exploited CVE-2025-66376 before a patch was available.
- The payload attempted to steal recent mail, directory information, passwords, multifactor tokens, and application passcodes.
- Patching needs to be followed by token revocation, credential resets, and investigation for persistent mailbox access.
The UK’s National Cyber Security Centre and international partners have exposed a Russian state-supported campaign that compromised vulnerable Zimbra webmail accounts when recipients viewed a malicious email.
The group, tracked by the UK as LAUNDRY BEAR, used CVE-2025-66376 before the vulnerability was publicly known or patched. Zimbra released a fix in November 2025, although the campaign had been operating since at least July of that year and continued to target organisations running exposed or unpatched installations.
Malicious JavaScript embedded in an email could execute when the message was rendered in the Zimbra web client. The recipient did not need to open an attachment, follow a link, or enter credentials into a fraudulent page. The group referred to the capability as Ulej, meaning beehive, and used it to collect email and establish continued access.
The joint technical advisory says the attackers attempted to obtain up to 90 days of email, the victim’s email address, global address-list information, passwords, multifactor authentication tokens, and application passcodes. An application passcode could then support persistent access through protocols such as IMAP after the original browser session ended.
Targeting included government, defence industrial organisations, energy, education, law enforcement, technology, media, and non-governmental bodies. The technique was tested extensively against Ukrainian targets before being used more broadly against NATO members and other Western organisations.
Awareness training remains useful against credential harvesting and malicious attachments, but it cannot prevent exploitation that occurs when a mail client performs its ordinary task of displaying a message. Security and maintenance of the collaboration platform become the decisive controls.
Self-hosted email systems can remain in service for long periods because they contain sensitive archives, integrate with identity infrastructure, and support workflows that are difficult to migrate. Those characteristics also make them valuable espionage targets. An internet-facing mail platform gives an attacker a route to users, authentication material, and historical communications without first compromising an endpoint.
Patching CVE-2025-66376 closes the known vulnerability but does not remove access established before the update. Organisations need to review Zimbra logs, identify suspicious message rendering and SOAP requests, revoke application passwords and active sessions, reset exposed credentials, and determine whether mail was exported.
Where directory information was taken, later phishing or impersonation attempts may use stolen organisational context. The theft of multifactor tokens and application passcodes also leaves persistent access outside the normal browser session, allowing a compromised account to remain available after the original email is deleted.
Authentication cannot be treated as a single control. Multifactor authentication reduces password-based compromise, but tokens, scratch codes, delegated credentials, and application passwords become part of the attack surface when the service holding them is exploited. Session lifetime, revocation capability, and monitoring for unusual protocol access determine whether an initial exploit becomes sustained espionage.
The participating agencies assess that LAUNDRY BEAR is almost certainly supported by the Russian state and primarily motivated by intelligence collection. They also judge that the method could be adapted to other enterprise email platforms, extending the defensive relevance beyond Zimbra’s installed base.
The NCSC has urged organisations to apply updates, restrict administrative access, monitor for the published indicators, and use its Early Warning service for notifications about activity affecting UK networks. Any organisation that exposed a vulnerable Zimbra service during the campaign period needs to establish whether patching occurred before or after the attackers created additional credentials.
