LAUNDRY BEAR exploits Zimbra zero-day via phishing emails
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Russian state-backed LAUNDRY BEAR targets Zimbra Collaboration Suite users with zero-day CVE-2025-66376, exfiltrating 90 days of emails and credentials via malicious email view.
Russian state-supported cyber actors tracked as LAUNDRY BEAR have been conducting a sophisticated phishing campaign against Western government and commercial organizations using Zimbra Collaboration Suite (ZCS) since at least July 2025. The group exploits CVE-2025-66376, a cross-site scripting vulnerability in ZCS email handling that was a zero-day when first exploited and was patched in November 2025. The attack requires no user interaction beyond viewing a malicious email in the ZCS webmail client—the embedded JavaScript payload executes automatically due to improper sanitization of CSS @import directives. Once triggered, the payload exfiltrates the victim's last 90 days of email communications, Global Address List, 2FA tokens, passwords via password manager autocomplete interception, and newly-created application passcodes. The group establishes persistence by enabling IMAP access and creating application-specific passwords for sustained mailbox access. Data is exfiltrated via DNS queries and HTTPS to infrastructure running the Flowerbed collection framework, deployed using Docker containers across short-lived virtual private servers. LAUNDRY BEAR demonstrates escalating technical sophistication, shifting from credential-stealing phishing (Evilginx AiTM attacks) to zero-day exploitation, suggesting Russian government backing for espionage operations. Affected organizations span defense industrial base, federal and local government, education, energy, law enforcement, media, NGOs, and technology sectors.
Mentioned in this report
Detection guidance
Zimbra Application-Specific Password Creation via SOAP API
Detects a request to the Zimbra SOAP endpoint that creates an application-specific password, which LAUNDRY BEAR used after XSS compromise to keep long-term mailbox access that bypasses 2FA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Zimbra Application-Specific Password Creation via SOAP API
description: Detects requests to the Zimbra SOAP endpoint CreateAppSpecificPasswordRequest.
After the XSS payload runs in a victim's webmail session, the actor creates app
passcodes for persistent mailbox access that bypasses 2FA. Review the source and
session context, since legitimate users also create these.
tags:
- attack.persistence
- attack.credential-access
- attack.t1556.006
- attack.t1114.002
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains: /service/soap/CreateAppSpecificPasswordRequest
condition: selection
falsepositives:
- Users legitimately creating app passwords for mail clients or mobile devices
- Helpdesk onboarding of new IMAP or mobile clients
level: medium
id: 486b6ca2-5738-5945-9b2c-bab251d8c39a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
Browser Process Issuing DNS Query With Very Long Encoded Label
Detects a web browser resolving a hostname with an unusually long encoded label, consistent with data exfiltration over DNS from injected webmail JavaScript. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Browser Process Issuing DNS Query With Very Long Encoded Label
description: Detects browsers resolving names whose leftmost label is a very long
alphanumeric string. The Zimbra XSS payload used by LAUNDRY BEAR exfiltrates mailbox
data, GAL entries and tokens through DNS queries as well as HTTPS. Volume or repetition
over time strengthens the signal.
tags:
- attack.exfiltration
- attack.t1048.003
- attack.t1119
logsource:
category: dns_query
product: windows
detection:
selection:
Image|endswith:
- \chrome.exe
- \msedge.exe
- \firefox.exe
- \brave.exe
QueryName|re: ^[a-zA-Z0-9_-]{50,}\.
condition: selection
falsepositives:
- CDN or telemetry hostnames with long hashed labels
- Browser-based security products that encode data in DNS lookups
level: low
id: e62d6509-732c-53db-ab0c-e7612d2db3e9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
Zimbra Mailbox Bulk Export Request via fmt Parameter
Detects Zimbra REST requests that export mailbox content as an archive (tgz/zip), which may indicate bulk collection of email from a hijacked webmail session. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Zimbra Mailbox Bulk Export Request via fmt Parameter
description: Detects Zimbra REST requests under /home/ that use fmt=tgz or fmt=zip
to export mailbox folders as an archive. This can indicate bulk email collection
from a compromised webmail session. Correlate with the user's normal behaviour and
with a preceding suspicious email view.
tags:
- attack.collection
- attack.t1114.002
- attack.t1560
logsource:
category: webserver
detection:
selection:
cs-method: GET
cs-uri-stem|contains: /home/
cs-uri-query|contains:
- fmt=tgz
- fmt=zip
condition: selection
falsepositives:
- Users exporting their own mailbox for backup or migration
- Administrators performing legal-hold or migration exports
level: low
id: 989bb381-3366-578c-b9d6-9631df4d491c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs