US Agencies Alert on Laundry Bear Campaign Targeting Zimbra Servers
The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Federal Bureau of Investigation (FBI) have jointly warned that the Russia-linked advanced persistent threat group Laundry Bear, also known as Void Blizzard, is actively targeting organizations using unpatched Zimbra Collaboration servers. The group exploits a critical vulnerability, CVE-2025-66376, which allows malicious JavaScript embedded in HTML emails to execute automatically when viewed, facilitating account theft without requiring user interaction.
Laundry Bear's campaign is notable for its use of a zero-click exploit, which differs from traditional phishing methods that typically rely on user actions like clicking links or downloading files. Instead, the group sends emails containing a malicious JavaScript payload that executes immediately upon the victim viewing the email in the Zimbra webmail platform. This vulnerability was exploited before its public disclosure and patch availability, highlighting the capabilities of emerging threat actors to weaponize unknown vulnerabilities.
The attack begins with phishing emails sent from previously compromised accounts, enhancing credibility and evading detection. Once victims open the message, the embedded JavaScript executes through abused CSS @import directives. The advisory explains that hidden within the email is a Base64 encoded payload that triggers the exploit, utilizing various instances of @import directives to leverage the vulnerability.
The malicious payload employs encryption and obfuscation techniques to bypass basic security controls, launching a multi-stage script aimed at reconnaissance, credential theft, and data collection. The malware seeks to maintain access by enabling IMAP, creating application passwords, harvesting two-factor authentication codes, and extracting saved browser password manager credentials. It collects extensive information, including mailbox data, user environment details, contacts, and emails from the past 90 days.
To ensure persistent access, the malware sends a SOAP request to modify mailbox settings, specifically to enable IMAP access. This action is likely intended to facilitate ongoing access to the victim's mailbox. The collected data is exfiltrated through HTTPS and DNS channels to infrastructure controlled by the attackers, utilizing a dedicated service named Catcher to temporarily store the stolen information.
CISA has released indicators of compromise (IOCs) associated with the Laundry Bear campaign, revealing that the attackers have registered deceptive domains to impersonate legitimate Zimbra infrastructure. These domains include mailnalysis.com, emailanalytics.com.ua, and zimbra-metadata.com, among others, which are used to support their operations and potentially collect stolen data.
To mitigate risks, CISA advises organizations running Zimbra to update their systems to the latest versions, review the published IOCs, and investigate any connections to the identified domains and IP addresses. Organizations should also monitor authentication activities for anomalies, revoke unauthorized application passcodes, and implement phishing-resistant multi-factor authentication to reduce the risk of account compromise. The advisory underscores the growing capabilities of smaller threat groups to exploit zero-day vulnerabilities and compromise enterprise email environments for intelligence gathering and further attacks.
