Russian state-backed hackers, identified as LAUNDRY BEAR, are exploiting a zero-day vulnerability in the Zimbra Collaboration Suite (ZCS) to stealthily extract sensitive information, including emails, from Western organizations.
This operation is focused on espionage rather than financial gain, targeting sectors such as government, defense, energy, education, media, NGOs, and technology.
The attack takes advantage of a vulnerability classified as CVE-2025-66376, which was a cross-site scripting flaw in ZCS webmail. The hackers utilize a unique capability called “Ulej” (meaning “beehive” in Russian) to execute their strategy.
The initial entry point for the attack is a spear-phishing email containing a JavaScript payload embedded within an SVG image. This exploit does not require users to click on links or open attachments; simply viewing the email in a vulnerable Zimbra client triggers code execution due to improper CSS handling.
Once executed, the JavaScript runs a series of automated steps to gather critical information from the victim’s account, including their email address, device status, OAuth consumers, and two-factor authentication (2FA) scratch codes.
The script enables IMAP access and generates a new Zimbra Application Passcode called “ZimbraWeb,” allowing the attackers ongoing access that circumvents ZCS’s native 2FA protections.
Additionally, the malicious payload attempts to manipulate password managers to auto-fill credentials into hidden login forms, allowing further credential theft.
Russian Hackers Exploiting Zimbra Zero-Day
For the email theft process, the script systematically queries the mailbox for non-junk messages from the past 90 days. The retrieved data is compressed and readied for transfer through the Ulej framework to servers controlled by the attackers, which run a Python-based collection system named “Flowerbed.”
This system ensures that redundant collection of already exfiltrated emails is avoided. However, emails from the current day are consistently collected with every exploit execution.
The exfiltration process utilizes both HTTPS and DNS as covert transmission methods. For smaller data items, the malware encodes information in Base32 and triggers DNS lookups through specially crafted image URLs.
Larger files, including email archives and Global Address List (GAL) contents, are transferred over HTTPS to the Flowerbed infrastructure, secured by Let’s Encrypt certificates and processed via an Nginx reverse proxy.
The Flowerbed setup employs Docker containers for various operational tasks, including HTTP/DNS exfiltration and health checks. It uses VPN services like Mullvad to obscure its activities.
JSON logs and payload files are carefully staged for exfiltration, with automated purging of older files to maintain operational stealth.
According to CISA Advisory AA26-204A, evidence suggests AI tools were used to help develop the Flowerbed codebase, highlighting a growing trend of threat actors leveraging artificial intelligence to accelerate offensive cyber operations.
Despite the stealthy nature of the campaign, there are detection opportunities for defenders. For instance, ZCS mailbox logs may show unusual SOAP activity indicative of compromise.
Additionally, entries in browser localStorage can reveal email exfiltration dates, assisting in incident response efforts. Organizations are urged to urgently patch the CVE-2025-66376 vulnerability and consider alternative methods for email access to safeguard against these stealthy attacks.
Recommending the revocation of all Zimbra Application Passcodes and two-factor authentication scratch codes is a crucial step in mitigating the risks posed by this advanced persistent threat.
