# LAUNDRY BEAR's Zero-Click Email Weapon: Russian Spies Are Draining Zimbra Inboxes Without a Single Click


## The Threat


LAUNDRY BEAR doesn't need you to click anything. That's the headline buried inside a sprawling joint advisory published this week by more than two dozen intelligence and cybersecurity agencies across North America, Europe, Australia, and New Zealand. The Russian state-sponsored APT — first named by Dutch intelligence services AIVD and MIVD — has been running a campaign against Zimbra Collaboration Suite (ZCS) deployments since at least July 2025, exploiting a zero-day vulnerability that fires the moment a target views a malicious email in the browser-based webmail client. No attachments. No links. No user mistake to blame.


The exploit, now tracked as CVE-2025-66376 and patched in November 2025, weaponizes a flaw in how ZCS's webmail renders incoming messages. When a victim's browser loads the malicious email, the exploit silently reaches out to attacker-controlled servers and begins pulling data: the last 90 days of email communications, the organization's Global Address List (essentially a directory of every employee and their contact information), and whatever other sensitive material it can grab. Then — because exfiltration alone isn't the end game — it attempts to establish persistent access to the compromised account through multiple footholds, ensuring LAUNDRY BEAR can return even if the initial intrusion is detected.


This is a meaningful escalation from the group's previous tradecraft. Earlier LAUNDRY BEAR campaigns leaned on blunt-force techniques: password spraying, credential phishing, pass-the-cookie attacks against session tokens. Those methods worked at volume but left obvious forensic traces and required victims to cooperate in their own compromise. A view-based zero-day is a different category of threat — it requires no behavioral failure from the target, it harvests intelligence passively, and it targets an email platform popular among government ministries, diplomatic missions, and public-sector organizations across the Western nations now countersigning this advisory.


## Severity and Impact


| Field | Detail |

|---|---|

| CVE | CVE-2025-66376 |

| CVSS Score | Critical (see official advisory for confirmed score) |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | Required (email view) |

| Scope | Data exfiltration + persistent account access |

| CWE | Pending — likely CWE-79 (XSS) or CWE-116 (improper encoding/escaping) |

| Zero-Day Status | Exploited as zero-day prior to November 2025 patch |

| Patch Available | Yes — November 2025 |


The view-based trigger is the critical detail: "user interaction required" in CVSS terms normally implies a deliberate action like clicking a link. Here, the interaction is simply reading email — something every employee does dozens of times daily. For practical purposes, defenders should treat this as zero-click in any realistic threat model.


## Affected Products


  • Zimbra Collaboration Suite (ZCS) — all versions prior to the November 2025 security patch

    • - Self-hosted ZCS deployments (on-premises)

    - Managed/hosted ZCS environments running unpatched versions

    - ZCS webmail interface specifically (the exploit fires through the browser-based client)


    Organizations running ZCS in air-gapped or restricted environments should verify patch status independently, as update cadence for isolated deployments often lags.


    ## Mitigations


    Immediate — patch first:

  • Apply the ZCS security update released in November 2025. This is the only remediation that closes CVE-2025-66376. Verify the installed version against Zimbra's release notes; don't rely on vendor notification alone.

    • Compensating controls while patching:

  • Restrict webmail access to known IP ranges or require VPN authentication before the ZCS interface is reachable — this raises the bar for opportunistic exploitation
  • Consider temporarily disabling HTML email rendering in ZCS and enforcing plain-text display, which disrupts the view-based exploit vector at the cost of formatting
  • Enforce email authentication (SPF, DKIM, DMARC) to reduce the attacker's ability to spoof trusted senders delivering the malicious payload

    • Persistence hunting:

  • Audit active ZCS sessions for unknown or anomalous OAuth tokens, app passwords, and forwarding rules — LAUNDRY BEAR's persistence mechanisms are the second priority after patching
  • Pull mail flow logs for the 90-day window prior to patch application and look for unusual outbound connections from ZCS servers, particularly to unexpected external IPs
  • Review the Global Address List access logs if available; bulk GAL retrieval is an indicator of compromise specific to this campaign

    • Longer-term hardening:

  • Segment email infrastructure from internal networks — email servers should not have direct lateral movement paths to sensitive systems
  • Enable MFA universally on ZCS accounts; while MFA doesn't prevent the email view exploit itself, it limits what attackers can do with harvested credentials for persistence
  • Log and alert on new mail forwarding rules created in ZCS — a common LAUNDRY BEAR persistence technique

    • ## References


  • Joint Cybersecurity Advisory — NSA, FBI, CISA, MIVD, AIVD, NCSC-UK, ASD's ACSC, and co-sealing partners (see official publication)
  • Zimbra Collaboration Suite Security Advisories: [https://wiki.zimbra.com/wiki/Security_Center](https://wiki.zimbra.com/wiki/Security_Center)
  • AIVD/MIVD original LAUNDRY BEAR attribution reporting
  • CISA Known Exploited Vulnerabilities Catalog: [https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

    • ---


    ## HackWire Analysis


    What strikes me most about this advisory isn't the exploit mechanics — it's the coalition that signed it. Fourteen intelligence agencies across Europe, plus NSA, FBI, CISA, and DCSA, plus Australia, Canada, and New Zealand. That's not a routine vulnerability disclosure. That's a political statement dressed in technical language, and it tells you something about how seriously Western intelligence services are taking LAUNDRY BEAR's current operational tempo.


    The timing matters too. CVE-2025-66376 was patched in November 2025 — meaning this advisory lands roughly eight months after the fix was available. The gap isn't oversight. It's because a meaningful slice of the target population still hasn't patched. Zimbra is disproportionately deployed in exactly the kinds of organizations that run lean IT teams: small government ministries, diplomatic missions, regional public sector bodies, NGOs with international reach. These are precisely the organizations LAUNDRY BEAR wants access to, and precisely the ones least likely to have a patch management program that moves at security speed.


    The shift from password spraying to a view-based zero-day also signals something worth tracking: LAUNDRY BEAR is leveling up its technical bench. Prior campaigns were characterized by volume and persistence over sophistication. A zero-day exploit that harvests 90 days of email silently — including the full organizational address book — is a much more surgical tool. The GAL exfiltration detail is particularly telling; that data is the scaffolding for every subsequent spear-phishing operation against the same organization's partners, suppliers, and government contacts.


    If your organization runs Zimbra, patch immediately and treat the November 2025 cutoff as a likely compromise date, not a starting assumption of safety.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)