# Your MFA Didn't Save You: How Laundry Bear Looted Zimbra Inboxes Without a Single Click
The moment you opened that email, the theft was already complete.
That's the operational reality CISA is now describing for organizations running unpatched Zimbra servers targeted by Laundry Bear — the Russian state-sponsored group Microsoft tracks as Void Blizzard. No malicious link. No attachment to open. No social engineering to resist. Just an HTML email arriving in your inbox, executing JavaScript the moment you view it, and quietly forwarding the last ninety days of your correspondence to a server in Moscow's orbit.
CISA published the advisory Wednesday alongside new technical detail on how the campaign worked — and the mechanics are worth understanding carefully, because the attackers didn't just steal email. They made sure they'd keep access long after you changed your password.
## The Flaw That Made It Possible
CVE-2025-66376 is a cross-site scripting vulnerability in Zimbra Collaboration Suite's Classic UI — the older, legacy interface that many enterprise deployments still run for compatibility reasons. XSS in an email client isn't a new concept, but Zimbra's implementation allowed JavaScript embedded in a crafted HTML email to execute automatically on message view. No preview pane exception. No safe-rendering sandbox. The victim's mail client just... ran the attacker's code.
Zimbra patched the vulnerability in November 2025. Laundry Bear had been exploiting it as a zero-day well before that, and according to CISA, continues to target organizations that haven't applied the fix. That gap — between patch availability and actual deployment — is where nation-state operators spend most of their time.
The exploit payload is precise and comprehensive. It collects the victim's last ninety days of email, their password, the full Global Address List, and — this is the critical detail — their active two-factor authentication tokens.
## The Part That Should Alarm Your SOC
Stealing 2FA tokens is useful but temporary. Tokens expire. What Laundry Bear did next is the part that separates sophisticated operators from commodity threat actors.
After the initial theft, the malware creates a new Zimbra application passcode and sends it back to attacker infrastructure. Application passcodes are a legacy compatibility feature — they exist so older mail clients like IMAP and ActiveSync can authenticate without supporting modern TOTP flows. Once created, they persist independently of any password reset or MFA change the victim might make.
Which means an organization could discover the compromise, force a password reset across all affected accounts, congratulate themselves on containment — and leave the attackers with functional IMAP credentials that still work.
The advisory specifically recommends revoking application passcodes with the 'ZimbraWeb' prefix. If you're running Zimbra and haven't audited these, that's the first thing to check.
## Flowerbed and the Dual Exfiltration Channel
The stolen data doesn't leave over a single channel. Laundry Bear routes exfiltration traffic through their "Flowerbed" collection framework using two methods simultaneously: smaller data packets — authentication material, metadata — travel over DNS encoded in A-record queries, while bulk mailbox contents are compressed and uploaded over HTTPS.
DNS-based exfiltration is a technique defenders often underweight. HTTPS gets monitored; DNS frequently doesn't. By using A-record queries for credential data, the most sensitive material travels over a channel that most organizations don't inspect for data exfiltration. The compression of mailbox archives for HTTPS upload is operationally clever — it reduces transfer time and often blends with legitimate backup traffic signatures.
The command-and-control infrastructure used domain names that mimicked Zimbra's own branding: mailnalysis.com, zimbrastat.com, zimbra-metadata.com, zmailanalytics.com. If your DNS monitoring doesn't flag outbound queries to those domains as suspicious, that's a gap worth closing.
## Who Got Hit, and Why This Target List Matters
CISA's target sector list reads like a comprehensive map of entities Russia has strategic interest in monitoring: Defense Industrial Base, federal and local government, energy, law enforcement, media, NGOs, and education.
Laundry Bear was first publicly attributed in May 2025 by Dutch intelligence services, following a 2024 compromise of the Dutch National Police that exposed personnel data. The group has been active since at least 2024, with consistent focus on NATO member states and — critically — organizations directly supporting Ukraine. Microsoft has documented successful intrusions against entities in defense and transportation sectors tied to Ukrainian logistics and assistance.
This is targeted espionage at scale. The Zimbra vulnerability gave them a way to conduct that espionage passively — no active phishing required once the initial email lands. For high-value targets, Laundry Bear supplemented the zero-click exploit with adversary-in-the-middle phishing kits impersonating Zimbra login portals to steal credentials and session cookies separately.
Two techniques. One group. Very patient.
## What You Actually Need to Do
CISA's standard recommendations apply — patch, check IOCs, monitor auth activity. The specific items worth prioritizing if you're a Zimbra shop:
---
## HackWire Analysis
The Zimbra zero-click campaign illustrates something that's been building across Russian state-sponsored operations since at least 2022: the shift from noisy intrusion to quiet, persistent collection against a coherent set of intelligence targets.
What makes CVE-2025-66376 notable isn't just that it's a zero-click — it's that it delivers persistent access *through* a security control most defenders consider a hard line. MFA bypass via application passcode creation isn't a vulnerability in the traditional sense; it's an abuse of a legitimate legacy feature that organizations forgot they'd left exposed. The attacker doesn't need to break your MFA. They create a parallel authentication path that exists outside the MFA flow entirely.
This pattern echoes how APT29 handled the Microsoft Exchange compromise in 2024 — not brute-forcing credentials, but finding the legacy compatibility seam that predated modern security controls and exploiting it quietly. The adversaries who do sustained damage aren't the ones who kick down the front door. They find the window you left unlocked for the old laptop in the conference room.
The ninety-day email collection is also worth dwelling on. Defenders tend to think about breaches in terms of what the attacker can do *going forward*. This campaign harvests backwards. Every sensitive thread, every internal discussion about procurement, strategy, personnel, or diplomatic coordination for the past three months gets vacuumed out with zero indicator on the endpoint. By the time a SOC identifies the compromise, the intelligence value has already been delivered.
For organizations in the DIB or actively supporting Ukraine-related logistics: assume Laundry Bear has already looked at your Zimbra deployment. If you're running Classic UI with an unpatched server from before November 2025, the question isn't whether you were targeted — it's whether the access was taken.
The CISA IOC list should be cross-referenced not just against current traffic but against historical DNS logs. The campaign was running before the patch existed.
— HackWire Editorial
---
## Related Coverage