Russian Laundry Bear Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

Campaign Overview

A Russian state-sponsored espionage group known as Laundry Bear (also tracked as Void Blizzard, CL-STA-1114, and TA488) exploited a zero-click cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite to silently exfiltrate 90 days of email, 2FA tokens, and MFA backup codes from targeted organizations across the US, NATO allies, and Ukraine.

CISA published joint advisory AA26-204A on July 22, 2026, attributing the campaign and detailing the technique. The flaw — CVE-2025-66376 — was patched by Zimbra in November 2025, but exploitation had been occurring for months before the fix.

The Vulnerability: CVE-2025-66376

How the Zero-Click Exploit Works

The attack is delivered as a malicious HTML email sent from Proton Mail accounts and previously compromised inboxes using generic "news digest" lures. The email body contains an SVG tag with an onload event handler, obfuscated using:

• Tag splitting to evade simple pattern matching
• Fake @import CSS directives
• HTML comment injection to break signature detection

When the victim opens or previews the email — no click required — the JavaScript executes in the context of their authenticated Zimbra session. The payload:

1. Exfiltrates the last 90 days of email to attacker-controlled infrastructure
2. Steals the victim's Zimbra email address and password
3. Harvests the Global Address List (GAL) — a directory of all organizational email contacts
4. Copies 2FA tokens and backup scratch codes stored in the account
5. Creates a new Zimbra application passcode under the attacker's control, enabling persistent IMAP/ActiveSync access that bypasses MFA entirely

Why 2FA Theft is Especially Dangerous

The theft of backup scratch codes is the most operationally damaging element of this campaign. Scratch codes are one-time recovery codes generated when a user first configures TOTP-based 2FA — they allow account recovery when a device is lost.

When an attacker holds backup scratch codes:

• Password resets do not evict the attacker — scratch codes bypass the TOTP flow entirely
• Standard incident response fails — the victim resets their password believing the account is secured, but the attacker retains access via scratch codes or the planted application passcode
• Persistent access survives detection — the attacker can maintain IMAP/ActiveSync sessions long after the phishing email is identified and removed

Targets and Scale

CISA's advisory identifies a wide victim set consistent with Russian strategic intelligence priorities:

• Defense Industrial Base (DIB)
• US federal and local government agencies
• Education sector
• Energy sector
• Law enforcement
• Media organizations
• NGOs and think tanks
• Technology companies

Ukrainian organizations were targeted extensively first — a pattern consistent with Russia using Ukraine as a proving ground for offensive capabilities before pivoting to US and NATO targets. Unit 42 (Palo Alto Networks) labeled the campaign Operation GhostMail.

Timeline

Defensive Actions

Immediate Patching

If you have not already: Update Zimbra Collaboration to 10.0.18 or 10.1.13 or later. This is non-negotiable. Organizations still running unpatched Zimbra should treat their email environment as potentially compromised.

Post-Exploitation Checks

1. Audit Zimbra application passcodes — Review all registered application passcodes for all user accounts. Look for passcodes created outside normal business processes or after the suspected exploitation window (mid-2025 onwards)
2. Invalidate all backup scratch codes — Force all users to regenerate their 2FA backup codes. Existing codes should be considered compromised
3. Review email forwarding rules — Attackers sometimes establish persistent access via server-side forwarding; audit all accounts for unexpected rules
4. Check GAL access logs — Bulk GAL downloads outside normal patterns may indicate the campaign touched your environment

Detection

• Monitor for SVG tag + onload attributes in inbound email HTML — this was the delivery mechanism
• Watch for email exfiltration patterns: large volumes of email sent from authenticated sessions at unusual hours
• Alert on new Zimbra application passcode creation that doesn't match IT provisioning workflows
• Review Zimbra server-side logs for the exploitation window (mid-2025 to November 2025 patch date)

References

• CISA Advisory AA26-204A
• CISA / DoD Joint CSA PDF
• The Hacker News — Laundry Bear Zimbra Coverage
• BleepingComputer — Zero-Click Zimbra Exploit
• CyberScoop — Operation GhostMail
• Unit 42 — Operation GhostMail Analysis
• Zimbra Security Advisory