# LAUNDRY BEAR exploits Zimbra zero-day via phishing emails

Published: 2026-07-23 · Severity: high · Sectors: defense, government-national, education, energy, technology, media, non-profit
Canonical: https://vorant.io/reports/4d63406b-f33f-5e6b-801d-56348d0fdeee/laundry-bear-exploits-zimbra-zero-day-via-phishing-emails

> Russian state-backed LAUNDRY BEAR targets Zimbra Collaboration Suite users with zero-day CVE-2025-66376, exfiltrating 90 days of emails and credentials via malicious email view.

Russian state-supported cyber actors tracked as LAUNDRY BEAR have been conducting a sophisticated phishing campaign against Western government and commercial organizations using Zimbra Collaboration Suite (ZCS) since at least July 2025. The group exploits CVE-2025-66376, a cross-site scripting vulnerability in ZCS email handling that was a zero-day when first exploited and was patched in November 2025. The attack requires no user interaction beyond viewing a malicious email in the ZCS webmail client—the embedded JavaScript payload executes automatically due to improper sanitization of CSS @import directives. Once triggered, the payload exfiltrates the victim's last 90 days of email communications, Global Address List, 2FA tokens, passwords via password manager autocomplete interception, and newly-created application passcodes. The group establishes persistence by enabling IMAP access and creating application-specific passwords for sustained mailbox access. Data is exfiltrated via DNS queries and HTTPS to infrastructure running the Flowerbed collection framework, deployed using Docker containers across short-lived virtual private servers. LAUNDRY BEAR demonstrates escalating technical sophistication, shifting from credential-stealing phishing (Evilginx AiTM attacks) to zero-day exploitation, suggesting Russian government backing for espionage operations. Affected organizations span defense industrial base, federal and local government, education, energy, law enforcement, media, NGOs, and technology sectors.

## Mentioned in this report

- Vulnerabilities: CVE-2025-66376 (KEV)
- Threat actors: TA488
- Malware: Flowerbed, Ulej

## Detection guidance (public sample)

### Zimbra Application-Specific Password Creation via SOAP API

ATT&CK: T1556.006

Detects a request to the Zimbra SOAP endpoint that creates an application-specific password, which LAUNDRY BEAR used after XSS compromise to keep long-term mailbox access that bypasses 2FA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Zimbra Application-Specific Password Creation via SOAP API
description: Detects requests to the Zimbra SOAP endpoint CreateAppSpecificPasswordRequest.
  After the XSS payload runs in a victim's webmail session, the actor creates app
  passcodes for persistent mailbox access that bypasses 2FA. Review the source and
  session context, since legitimate users also create these.
tags:
- attack.persistence
- attack.credential-access
- attack.t1556.006
- attack.t1114.002
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains: /service/soap/CreateAppSpecificPasswordRequest
  condition: selection
falsepositives:
- Users legitimately creating app passwords for mail clients or mobile devices
- Helpdesk onboarding of new IMAP or mobile clients
level: medium
id: 486b6ca2-5738-5945-9b2c-bab251d8c39a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
```

### Browser Process Issuing DNS Query With Very Long Encoded Label

ATT&CK: T1048.003

Detects a web browser resolving a hostname with an unusually long encoded label, consistent with data exfiltration over DNS from injected webmail JavaScript. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Browser Process Issuing DNS Query With Very Long Encoded Label
description: Detects browsers resolving names whose leftmost label is a very long
  alphanumeric string. The Zimbra XSS payload used by LAUNDRY BEAR exfiltrates mailbox
  data, GAL entries and tokens through DNS queries as well as HTTPS. Volume or repetition
  over time strengthens the signal.
tags:
- attack.exfiltration
- attack.t1048.003
- attack.t1119
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    Image|endswith:
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    - \brave.exe
    QueryName|re: ^[a-zA-Z0-9_-]{50,}\.
  condition: selection
falsepositives:
- CDN or telemetry hostnames with long hashed labels
- Browser-based security products that encode data in DNS lookups
level: low
id: e62d6509-732c-53db-ab0c-e7612d2db3e9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
```

### Zimbra Mailbox Bulk Export Request via fmt Parameter

ATT&CK: T1114.002

Detects Zimbra REST requests that export mailbox content as an archive (tgz/zip), which may indicate bulk collection of email from a hijacked webmail session. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Zimbra Mailbox Bulk Export Request via fmt Parameter
description: Detects Zimbra REST requests under /home/ that use fmt=tgz or fmt=zip
  to export mailbox folders as an archive. This can indicate bulk email collection
  from a compromised webmail session. Correlate with the user's normal behaviour and
  with a preceding suspicious email view.
tags:
- attack.collection
- attack.t1114.002
- attack.t1560
logsource:
  category: webserver
detection:
  selection:
    cs-method: GET
    cs-uri-stem|contains: /home/
    cs-uri-query|contains:
    - fmt=tgz
    - fmt=zip
  condition: selection
falsepositives:
- Users exporting their own mailbox for backup or migration
- Administrators performing legal-hold or migration exports
level: low
id: 989bb381-3366-578c-b9d6-9631df4d491c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4d63406b-f33f-5e6b-801d-56348d0fdeee/laundry-bear-exploits-zimbra-zero-day-via-phishing-emails.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup