Published Thursday, July 23, 2026 at 03:04 PM PT
BLUF: Russian state-sponsored espionage group (assessed as Laundry Bear) has been exploiting a Zimbra Collaboration Suite zero-day vulnerability for at least five months (discovered early 2025, patched November 2025) to harvest email and two-factor authentication codes from Western government and private-sector targets. The group continues active exploitation in unpatched or improperly-updated environments. All organizations running Zimbra must immediately verify patch status and isolation posture—patching alone is insufficient without concurrent access reviews.
DETAILS
• Vulnerability & timeline: Zero-day zero-click flaw in Zimbra Collaboration Suite, exploited for ~5 months prior to patch release (November 2025). Multiple intelligence sources (CyberScoop, BleepingComputer, Unit 42, CISA, ACSC) confirm active exploitation window.
• Attack vector: JavaScript injection into webmail interface; enables credential harvesting, email exfiltration, and pass-the-cookie attacks. No user interaction required (zero-click).
• Threat actor: Russian state-sponsored group, assessed as Laundry Bear. EU issued sanctions against named Russian intelligence officers (June–July 2026) for conducting yearslong cyber espionage campaigns using this and related methods.
• Ongoing threat: Despite November 2025 patch availability, actor continues exploitation of unpatched/improperly-updated Zimbra deployments. No intelligence suggests exploitation of post-patch systems, but verification is critical.
• Collection targets: Email communications and two-factor authentication tokens—enabling lateral movement, credential access, and persistence in targeted networks.
IMPACT
Confirmed affected scope: Western government agencies, diplomatic missions, NGOs/human rights organizations, private-sector entities with Zimbra deployments. Exact victim count uncertain (assessment: dozens to hundreds).
Data compromised: Email contents (full archive scope unknown per available reporting), 2FA tokens, and derived credentials enabling downstream compromise.
Exposure window: Five months of undetected access in some cases; ongoing in unpatched environments.
RECOMMENDED ACTIONS — IMMEDIATE (24–48 hrs)
- Verify patch status — Query all Zimbra instances for November 2025+ patch application; flag any version <2025-11 for emergency update.
- Review access logs — Search Zimbra audit logs (if retained) for anomalous JavaScript injection, credential usage, cookie-based logins from unfamiliar IPs, and bulk mail exports.
- Force credential reset — Require password and 2FA regeneration for all accounts with Zimbra access; assume 2FA tokens harvested during exploitation window.
- Segment Zimbra network — Isolate Zimbra servers from sensitive internal systems until environment hardening complete.
SOURCES
— CyberScoop, “Russian espionage group using novel Zimbra exploit” (July 2026)
— BleepingComputer, “Russian hackers exploit Zimbra zero-click flaw”
— Unit 42 Palo Alto Networks, “Russian Global Webmail Espionage”
— CISA Alerts (Russian state-supported cyber actors, Zimbra targeting)
— Australian Cyber Security Centre, Joint Advisory on Zimbra exploitation
— EU Sanctions Notice, Russian Intelligence Officers (June–July 2026)
Recent high-severity events at publish time:
