Russian Hackers Exploit Email Vulnerability to Steal Sensitive Data
U.S. and allied cyber-intelligence authorities have reported that Russian state-backed hackers are exploiting a vulnerability in the Zimbra Collaboration Suite to steal sensitive information from Western government agencies. This method, identified as a zero-click exploit, allows hackers to access emails, passwords, and authentication data without requiring victims to click on malicious links or download attachments. Instead, the exploit activates when a victim opens or previews an email in an unpatched version of the software.
The hacking group, known as Laundry Bear, has successfully targeted more than ten organizations since July 2025, impacting various sectors including the defense industrial base, federal and local governments, law enforcement, technology companies, educational institutions, media outlets, and NGOs. The hackers aim to collect email addresses, passwords, and two-factor authentication tokens, which can provide ongoing access to compromised accounts even after a password change. They also attempt to gather an organization’s email directory and up to 90 days of communications.
The Financial Crimes Enforcement Network (FinCEN) of the Treasury Department purchased a Zimbra standard support subscription in February 2025, but it remains unclear if they were using the vulnerable version of the software or were targeted in this campaign. CISA noted that unlike traditional phishing attacks, which rely on user interaction, Laundry Bear's current campaign utilizes a zero-click exploit that only requires the victim to view a malicious email.
Proofpoint, which has investigated the activity, refers to this technique as a “half-click” exploit, as it necessitates the victim to open or preview the email. Once the message appears in a vulnerable Zimbra webmail client, no further interaction is needed. The emails are sent from both attacker-controlled Proton Mail accounts and previously compromised addresses. One example involved a message purporting to be from a Belgian media-verification organization, which included a legitimate-looking link to an EU events calendar, while the malicious code was embedded directly in the email.
CISA has urged organizations to update their Zimbra mail software, monitor for suspicious activity, and review the technical indicators provided in their advisory. Organizations that suspect a compromise are advised to follow the remediation guidance from the agencies rather than relying solely on installing the patch. Chris Butera, acting executive assistant director for cybersecurity at CISA, emphasized the increasing sophistication of nation-state cyber groups and their ability to disrupt critical infrastructure or conduct espionage. The advisory has received support from defense, cybersecurity, and intelligence agencies from Australia, Canada, New Zealand, the UK, and over a dozen European countries.
