A group of Russian state-supported hackers has been quietly stealing emails from Western governments, defense contractors and NGOs by exploiting a flaw in the Zimbra webmail platform that requires no clicks at all. In a joint advisory published on 22 July, the US National Security Agency, FBI and Britain's National Cyber Security Centre, alongside agencies from 15 other countries, exposed the group they primarily track as LAUNDRY BEAR (also called Void Blizzard) and warned that the campaign is still running.
What makes this operation dangerous is that a victim only has to open a booby-trapped email in a vulnerable version of Zimbra Collaboration Suite (ZCS) to be compromised. There is no link to click and no attachment to open. The moment the message is viewed, hidden JavaScript runs inside the webmail session and begins stealing the victim's last 90 days of email, their password, two-factor authentication tokens and the organization's full address book.
What happened
The agencies say LAUNDRY BEAR has been targeting ZCS users since at least July 2025, when the technique was a true zero-day. The underlying vulnerability, tracked as CVE-2025-66376, is a cross-site scripting flaw that lets an attacker smuggle a script into an email through improperly sanitized CSS "@import" directives. Zimbra's vendor Synacor patched it and the bug was formally published in January 2026, but the actors continue to hit organizations that have not updated. The custom exfiltration tool behind the campaign is named "Ulej" (Russian for beehive), and the advisory nicknames the zero-click technique "beehive".
US victims span the defense industrial base, federal and local government, education, energy, law enforcement, media, NGOs and technology. Palo Alto Networks' Unit 42, which independently tracks the same activity as CL-STA-1114, reports the same view-based Zimbra exploit hitting government, defense, transport and financial targets across NATO states, Ukraine, Commonwealth of Independent States countries and Africa, using at least nine command-and-control IP addresses and nine domains.
How the attack works
The malicious email hides a Base64-encoded payload inside an invisible SVG element. When the webmail client renders the message, the payload decodes and runs a script that collects data in a dozen automated stages: it grabs the email address, environment details, 2FA codes and saved passwords, enables IMAP access and creates an application-specific passcode so the attackers keep a foothold even where two-factor authentication is enabled. Stolen data is shipped to attacker-run servers running a Python collection framework the agencies call "Flowerbed". Notably, both the advisory and the NCSC assess that artificial intelligence likely helped write parts of that simple codebase, a sign of how AI is lowering the bar for even less sophisticated groups.
Who is behind it
The authoring agencies assess that the campaign is almost certainly espionage carried out with Russian state backing, given its covert, persistent nature and the absence of any extortion. They also flag a now-familiar pattern: the techniques were trialed extensively against Ukrainian victims before being turned on NATO members. Different vendors track overlapping clusters as LAUNDRY BEAR, Void Blizzard, CL-STA-1114 and TA488, so attribution names may not map one-to-one.
What you should do
Organizations running Zimbra Collaboration Suite should patch CVE-2025-66376 immediately if they have not already, then hunt for compromise: unexpected IMAP activations, newly created application passcodes and connections to the published indicators. Selected defanged indicators include the C2 IPs 216[.]252[.]238[.]104, 37[.]120[.]247[.]228 and 194[.]156[.]103[.]193, and domains such as zimbra-metadata[.]com, zmailanalytics[.]com and synacorzimbra[.]nl. Because the agencies warn the "beehive" technique could be adapted to other webmail platforms, defenders should also tighten email monitoring more broadly. This campaign follows a run of exposed Russian operations, including the recent 12-nation warning that Russia's FSB was hijacking poorly secured routers and the hijacking of ViPNet updates to backdoor Russian networks.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.