# Russia's Laundry Bear Found the Hole You Can't Train Users to Avoid
A phishing campaign is only as dangerous as its weakest link — usually the human who clicks. Russia just cut the human out of the equation.
For the past year, a Russian state-sponsored group operating under the tracking name "Laundry Bear" has been quietly compromising Zimbra Collaboration Suite servers belonging to Western governments, militaries, and enterprises — not by convincing anyone to click a link, but by weaponizing the act of *reading email*.
The technique, detailed in a joint advisory issued Thursday by the US government and intelligence partners from over a dozen countries, is being called a "half-click exploit." Open the message. Preview the message. That's enough. The malicious payload executes before the target has made any decision at all.
## What CVE-2025-66376 Actually Does
The vulnerability lives in Zimbra's Classic UI — specifically in how the webmail client handles CSS @import directives embedded in HTML email. Attackers crafted messages that abused this parsing behavior to trigger a stored cross-site scripting condition. When a vulnerable server renders the email, the payload fires. No attachment. No suspicious link to hover over. No social engineering required beyond getting the email delivered.
This isn't theoretical. The advisory confirms successful intrusions at Western government networks and enterprises. Seqrite documented a Ukrainian government compromise attributed to Laundry Bear in March, using this same mechanism.
The technical elegance here is worth acknowledging — and it's what makes the delayed disclosure so galling.
## Zimbra Patched It Quietly. Then Said Nothing.
Zimbra shipped version 10.1.13 in November 2025. The release notes described the fix as patching "a stored XSS vulnerability in the Classic UI where attackers could abuse CSS @import directives in email HTML." No CVE. No advisory. No urgency.
It wasn't until early January 2026 that NIST and MITRE published entries for CVE-2025-66376. Zimbra and its parent company Synacor have not publicly addressed why there was a weeks-long gap between the patch and the CVE assignment — and neither responded to press inquiries.
That gap matters enormously. Defenders running patch management programs rely on CVE identifiers to prioritize work. An unannounced fix in release notes, buried under feature updates, is easy to miss. Organizations that hadn't upgraded to 10.1.13 by January had no formal signal from Zimbra that they were sitting on a zero-day being actively exploited by a Russian APT.
Laundry Bear knew. They'd been running this campaign since July 2025 — four months before the patch dropped, and over five months before defenders got a CVE to act on.
## The Targets and the Intelligence Mission
The advisory describes the campaign's goal as gathering sensitive information for the Russian Federation. That's diplomatic language for sustained espionage against Western governments, defense-adjacent organizations, and Ukrainian infrastructure — the same menu Russia's APT ecosystem has been running for years.
Laundry Bear joins a crowded roster. Fancy Bear (APT28) and Cozy Bear (APT29) remain the most notorious, but the ecosystem is broader and the tooling is increasingly varied. What distinguishes this campaign is the operational patience: a year of activity against a specific software platform, leveraging an exploit that bypasses the one security control organizations have invested most heavily in — user training.
When security teams spend years training employees to spot phishing, attackers respond by eliminating the click. This is the logical endpoint of that arms race.
## Who Is Still Exposed
Zimbra isn't Exchange, but it's not obscure either. It's heavily used in government agencies — particularly in Eastern Europe, the Middle East, and among organizations that moved away from Microsoft infrastructure for cost or sovereignty reasons. The joint advisory's breadth (a dozen-plus nations) suggests Laundry Bear has hit targets across multiple continents.
Organizations running Zimbra should verify immediately:
## HackWire Analysis
The Laundry Bear campaign deserves attention beyond its technical specifics — because it represents a maturation in how nation-state actors think about email-based intrusion.
Traditional phishing campaigns are constrained by conversion rates. You send a million emails, some percentage opens them, a smaller percentage clicks, a smaller percentage has credentials you can actually use. Every step is a filter. Laundry Bear's half-click exploit collapses that funnel: delivery is compromise.
This has happened before in a different context. The 2020 Zimbra vulnerability CVE-2020-12271, exploited by APT31, also involved client-side rendering abuse — though that required JavaScript execution from a link click. The evolution from "trick them into clicking" to "make opening the email sufficient" is a qualitative shift, and it will be replicated. Once a technique proves durable across multiple campaigns, it gets commoditized.
What other reporting is missing here: the disclosure timeline story is bigger than it's being treated. Zimbra's silent-patch approach isn't unique — vendors do this regularly, often to avoid tipping off attackers. But the asymmetric information problem cuts both ways: defenders are left blind. The argument for minimal disclosure becomes much harder to defend when a Russian APT is already in active exploitation and the patch lands in release notes with no urgency signal. CISA has pushed vendors on disclosure quality for years. This case should renew that pressure specifically around the patch-to-CVE lag window.
For security teams: the lesson isn't "never use Zimbra." It's that email rendering engines are attack surfaces, and any webmail system that processes rich HTML client-side carries this class of risk. The defense posture needs to include disabling unnecessary rendering features, accelerating patch cycles for email infrastructure, and treating the patch changelog — not just CVE feeds — as a threat intelligence input.
— HackWire Editorial
## Related Coverage