Russian APT 'Laundry Bear' Exploited Zimbra Zero-Day with Half-Click Email Attack

Overview

A Russia-backed advanced persistent threat group known as Laundry Bear (also tracked as Void Blizzard by Microsoft and TA488 by Proofpoint) exploited a zero-day vulnerability in Zimbra Collaboration Suite to compromise government, defense, energy, and NGO targets across Ukraine, the United States, and NATO member countries.

On July 23, 2026, CISA, the NSA, FBI, and allied intelligence agencies from the Netherlands, UK, Australia, and Canada released a joint advisory (CISA AA26-204A) disclosing the campaign. The attack technique — called a "half-click" exploit by researchers — allows the threat actor to steal a victim's email, bypass multi-factor authentication, and establish persistent access with no more user interaction than opening or previewing an email.

The Vulnerability: CVE-2025-66376

The vulnerability exists in how Zimbra's Classic UI handles CSS @import directives within HTML email messages. Zimbra failed to sanitize this directive properly, allowing an attacker to embed malicious JavaScript that executes when the victim views or previews the email — no link click required.

The Half-Click Attack: How It Works

Proofpoint coined the term "half-click" for this attack class because it bypasses the conventional phishing requirement that a victim click a link or open an attachment. The attack chain:

1. Laundry Bear sends a crafted HTML email containing a malicious payload hidden inside an SVG element
2. The payload uses Base64 encoding, XOR encryption, and variable CSS directives to evade signature-based detection
3. When the email is rendered in Zimbra's Classic UI, the mishandled @import directive triggers the embedded JavaScript
4. The JavaScript payload — codenamed "Ulej" (Russian for "beehive") internally by Laundry Bear, and ZimReaper by Proofpoint — executes in the victim's browser session
5. ZimReaper queries the mailbox via Zimbra SOAP requests and exfiltrates:
   • The last 90 days of email
   • The victim's email address and password
   • The Global Address List (GAL)
   • Active 2FA/TOTP tokens
6. ZimReaper mints a new Zimbra application-specific password named "ZimbraWeb" — the type used by legacy IMAP/POP3/ActiveSync clients that don't require TOTP
7. This app-specific password is exfiltrated via a DNS query to attacker-controlled infrastructure
8. Using this credential, Laundry Bear gains persistent IMAP/SMTP access that bypasses MFA — and this access survives even if the victim later changes their password

Critical: Patching Zimbra alone does not remediate already-compromised accounts. All application-specific passwords must be revoked on any account that may have been exposed.

The Threat Actor: Laundry Bear

Laundry Bear was first publicly named in May 2025 after Dutch intelligence agencies (AIVD/MIVD) attributed a breach of the Dutch National Police to the group. US federal indictments have confirmed the group is a private contractor working for Russian intelligence.

Previous Laundry Bear campaigns relied on unsophisticated methods: password spraying, adversary-in-the-middle phishing, and session-token replay against cloud email environments. The Zimbra zero-day represents a significant capability escalation — the group's first publicly documented use of a novel zero-day exploit.

Dutch and US intelligence jointly assess that the group's targeting "almost certainly indicates espionage activities with Russian government backing."

Targets

The campaign began with extensive targeting of Ukrainian organizations before expanding to US and NATO allies. Confirmed targeted sectors per the CISA advisory:

• Defense Industrial Base (DIB)
• Federal and local government
• Education
• Energy
• Law enforcement
• Media
• Non-governmental organizations (NGOs)
• Technology

The expansion to broader NATO targets follows the group's known intelligence priorities related to the Russia-Ukraine conflict and Western defense posture.

Zimbra's Response

Zimbra released the patch on November 6, 2025 in Zimbra 10.1.13 and 10.0.18. However, the patch release notes described the fix only as correcting "a stored XSS vulnerability in the Classic UI where attackers could abuse CSS @import directives in email HTML" — with no CVE number and no disclosure of active exploitation at the time.

The CVE number was not formally published until January 5, 2026, leaving organizations without a clear urgency signal for months after the patch shipped.

Note: Zimbra 10.0.x reached end-of-life on December 31, 2025. Organizations on the 10.0 branch must upgrade to 10.1.x for a supported, long-term-secure deployment.

The joint advisory also flags Operation RoundPress — a related campaign attributed to a different Russian actor (TA458) that used similar half-click XSS exploits against Kerio Webmail and SOGo Webmail (CVE-2026-8496, patched in SOGo 5.12.8), indicating that half-click email exploitation is a broader Russian intelligence tradecraft pattern.

Remediation Steps

Organizations running Zimbra should take the following actions immediately:

1. Patch to Zimbra 10.1.13 — the only supported branch with the fix
2. Revoke all application-specific passwords on any account that may have been exposed — patching alone is insufficient
3. Audit IMAP connections for logins from unfamiliar IP addresses, particularly VPS infrastructure
4. Monitor DNS traffic for unusual queries with randomized subdomains to external resolvers
5. Check for new application passwords named "ZimbraWeb" or similar variants in user account settings
6. If immediate patching is not possible, redirect users to a mail client that does not use the Zimbra Classic UI
7. Treat this as a potential full mailbox compromise: assume all email back to at least July 2025 may have been exfiltrated for unpatched accounts

References

• Dark Reading — Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets
• CISA Advisory AA26-204A — Laundry Bear Exploiting CVE-2025-66376
• Proofpoint — ZimReaper: Laundry Bear's Half-Click Zimbra Exploit
• Zimbra — Security Advisory CVE-2025-66376