Year-long Russian attacks infect users as soon as they look at an email

1. Executive summary

A Russia-linked threat actor tracked as Laundry Bear (aka Void Blizzard) has been conducting a year-long espionage campaign — ongoing since July 2025 — exploiting CVE-2025-66376 (CVSS 7.2 HIGH, CWE-79, in CISA KEV since 2026-03-18) in the Zimbra Collaboration Suite (ZCS). The flaw is a stored cross-site scripting (XSS) vulnerability that enables zero-click compromise: merely viewing a malicious HTML email in the ZCS webmail client triggers JavaScript execution, leading to exfiltration of the last 90 days of email, credentials, global address lists, 2FA tokens, and application passcodes. Attribution to Laundry Bear / Void Blizzard is unconfirmed — neither actor has a MITRE ATT&CK profile in the verified reference data. EMEA financial services running unpatched ZCS webmail are at direct risk of credential theft and email-data exfiltration.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (multi-source corroborated)

1. Initial access — zero-click XSS via malicious email. The attacker sends a crafted HTML email to the target's ZCS webmail account. The email exploits CVE-2025-66376 (CVSS 7.2 HIGH, CWE-79), a stored XSS vulnerability in Zimbra Collaboration Suite. No user interaction beyond viewing the email in the ZCS webmail client is required — no link click, no attachment open. Malicious JavaScript executes in the context of the victim's ZCS webmail session upon rendering.
2. Data exfiltration. Upon JavaScript execution, the attacker's payload exfiltrates: - The victim's last 90 days of email communications. - Email addresses and passwords. - Organisation email directories, including global address lists. - Two-factor authentication (2FA) tokens. - Newly created application passcodes.
3. Credential abuse and persistence. Attackers use the stolen credentials to maintain ongoing access to victim email accounts. They modify account preferences and continue collecting authentication information, enabling persistent access without re-exploitation.
4. Collection infrastructure. Exfiltrated data is stored on an unattributable VPS running a custom collection framework called "Flowerbed." Flowerbed is a Python project that uses Docker for containerization. The 27-agency alert notes that the Flowerbed codebase has indications that AI played a role in its development.

Campaign scope and targeting

• Active since July 2025; CVE-2025-66376 was patched in November 2025, but exploitation predates the patch.
• Targeted sectors: defence industrial base, federal and local governments, education, energy, law enforcement, media, NGOs, and technology. While financial services is not explicitly named in the source material, any organisation running unpatched ZCS webmail is technically vulnerable.
• Attributed to Laundry Bear / Void Blizzard by a coalition of 27 US, UK, and international government agencies. Attribution caveat: Neither Laundry Bear nor Void Blizzard has a MITRE ATT&CK profile in the verified reference data; treat the attribution as unconfirmed. The stated objective is covert acquisition of email data for the Russian Federation.

Sender email addresses used in the campaign (from the primary source)

• ivanka.zurabishvili@proton[.]me
• zmul1@buildandconsulting[.]com
• garrysmithme@pinmx[.]net
• hostingclient@pinmx[.]net

4. Mitigation & containment

P1 — within 24 hours

• Patch ZCS immediately. Upgrade all Zimbra Collaboration Suite instances to a version patched against CVE-2025-66376. The patch was released in November 2025. Verify patch level across all ZCS nodes, including any DR or standby instances.
• Restrict webmail access. Until patching is confirmed, minimise employee use of the ZCS webmail client. Enforce MFA on all ZCS accounts where available. Consider temporarily blocking external access to the ZCS web interface (port 443/8443) via WAF or reverse proxy, permitting only VPN-accessed sessions.
• Hunt for compromise. Search ZCS logs and mailboxes for emails from the four sender addresses listed in §5. Review ZCS audit logs for abnormal account preference modifications, new application passcode creation, and unusual IMAP/ActiveSync device registrations dating back to July 2025.
• Rotate credentials. For any account showing signs of compromise, force password resets, revoke all active sessions and tokens, revoke and re-enrol 2FA, and invalidate all application-specific passwords.

P2 — within 72 hours

• Deploy WAF rules to detect and block XSS payloads targeting ZCS webmail endpoints. Inspect inbound HTML email content for <script> tags and JavaScript event handlers (onload, onerror, onmouseover, etc.) in messages delivered to ZCS mailboxes.
• Review the 31-page joint advisory's IOC section (published by the 27-agency coalition) and import indicators into SIEM/EDR for retrospective detection.
• Audit ZCS mailbox forwarding rules and delegation. Look for auto-forwarding rules or mailbox folder sharing that the attacker may have configured for silent collection.

P3 — within 7 days

• Network-level blocking. Block outbound connections from ZCS servers to unattributed VPS infrastructure identified in the advisory's IOC section. The Flowerbed framework communicates from the victim's browser context, so also inspect proxy/egress logs for unusual POST requests from user workstations to external IPs/domains.
• Review email security gateway configuration. Ensure HTML email sanitisation is enabled; consider stripping or neutralising inline JavaScript in inbound HTML messages at the mail gateway.
• Validate third-party ZCS hosting providers. If ZCS is operated by a third-party provider, confirm patch status in writing and review contractual security obligations.

5. Indicators of compromise

email  ivanka.zurabishvili@proton[.]me
email  zmul1@buildandconsulting[.]com
email  garrysmithme@pinmx[.]net
email  hostingclient@pinmx[.]net

Behavioural indicators

6. Detection

rule Laundry_Bear_Flowerbed_Framework {
    meta:
        author = "Adverse Trace"
        date = "2026-07-23"
        reference = "https://www.theregister.com/patches/2026/07/23/year-long-russian-attacks-infect-users-as-soon-as-they-look-at-an-email/5277358"
        description = "Detects Flowerbed collection framework — Python/Docker-based exfiltration tool attributed to Laundry Bear campaign"
    strings:
        $docker = "Docker" ascii
        $python = "python" ascii
        $flowerbed = "Flowerbed" ascii
    condition:
        2 of them
}

title: Zimbra CVE-2025-66376 Zero-Click XSS — Malicious Email from Laundry Bear Senders
id: 7a3c1f2e-2026-0723-4b8d-9c1a-laundrybear
status: experimental
description: Detects inbound emails from known Laundry Bear campaign sender addresses targeting ZCS webmail users
author: Adverse Trace
date: 2026/07/23
references:

    - https://www.theregister.com/patches/2026/07/23/year-long-russian-attacks-infect-users-as-soon-as-they-look-at-an-email/5277358
logsource:
    product: email
    service: delivery
detection:
    selection_sender:
        sender:

            - "ivanka.zurabishvili@proton.me"
            - "zmul1@buildandconsulting.com"
            - "garrysmithme@pinmx.net"
            - "hostingclient@pinmx.net"
    condition: selection_sender
falsepositives:

    - Legitimate use of these email addresses (unlikely given campaign context)
level: high

title: ZCS Account Preference Modification Following Suspicious Email Delivery
id: 8b4d2g3f-2026-0723-5c9e-0d2b-zcsmod
status: experimental
description: Detects ZCS account preference changes (forwarding rules, delegation, app passcodes) that may indicate post-exploitation credential abuse by Laundry Bear
author: Adverse Trace
date: 2026/07/23
references:

    - https://www.theregister.com/patches/2026/07/23/year-long-russian-attacks-infect-users-as-soon-as-they-look-at-an-email/5277358
logsource:
    product: zimbra
    service: audit
detection:
    selection_action:
        action:

            - "modifyAccountPreferences"
            - "createAppPasscode"
            - "addMailForwardingRule"
            - "grantMailboxAccess"
    filter_known_admin:
        user: known_admin_accounts
    condition: selection_action and not filter_known_admin
falsepositives:

    - Legitimate user-initiated preference changes
level: medium

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• The Register — "Year-long Russian attacks infect users as soon as they look at an email" — https://www.theregister.com/patches/2026/07/23/year-long-russian-attacks-infect-users-as-soon-as-they-look-at-an-email/5277358 — 2026-07-23
• BleepingComputer — "Russian hackers exploit Zimbra zero-click flaw for email theft" — https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-zimbra-zero-click-flaw-for-email-theft/ — 2026-07-23
• The Record (Recorded Future) — "International alert spotlights Russia-linked attacks on Zimbra webmail" — https://therecord.media/zimbra-webmail-zero-click-phishing-russia-laundry-bear — 2026-07-23
• Cybersecurity Dive — "Russia-backed threat actor targets Western organizations in phishing campaign" — https://www.cybersecuritydive.com/news/russia-threat-actor-western-organizations-Zimbra-phishing/826029/ — 2026-07-23

8. Adverse Trace position

This is a HIGH-severity (CVSS 7.2) actively exploited vulnerability — confirmed in CISA KEV since 2026-03-18 — with a zero-click delivery mechanism that bypasses traditional phishing controls and user awareness training. The campaign has been operational for over a year and targets email data and authentication material, making it directly relevant to EMEA financial services that run Zimbra Collaboration Suite. Attribution to Laundry Bear / Void Blizzard is unconfirmed (no MITRE ATT&CK profiles in verified reference data) but is supported by a 27-agency coalition alert, which elevates confidence in the attribution claim itself while we flag the absence of MITRE corroboration. The Flowerbed framework's AI-assisted development is a single-sourced claim from the advisory; verify before treating as confirmed. Clients should treat patching ZCS as an immediate P1 action and conduct retrospective hunting back to July 2025 using the sender addresses and behavioural indicators in this advisory. We will monitor for additional IOCs from the full 31-page advisory and update this note if financial-services-specific targeting emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.