Year-long Russian attacks infect users as soon as they look at an email
A Russia-linked cyber-espionage group known as Laundry Bear has reportedly exploited a vulnerability in Zimbra email software to compromise government and commercial organisations since July 2025. The attack is particularly serious because victims can be infected simply by viewing a malicious email, without clicking a link or opening an attachment, enabling attackers to steal sensitive communications and maintain access to accounts.
The campaign targets CVE-2025-66376, an XSS flaw patched in November 2025, and has affected organisations across defence, government, education, energy, law enforcement, media, NGOs and technology. A joint alert from 27 international agencies says attackers have taken up to 90 days of email, credentials, directories, two-factor authentication tokens and application passcodes, storing data through a custom framework called Flowerbed; agencies advise updating Zimbra and reducing use of its webmail client until patched.
In short
- Russian-linked attackers exploited Zimbra emails viewed by victims.
- The campaign has run since July 2025.
- Organisations should apply patches and limit vulnerable webmail use.
Explained simply
Zimbra is email software used by thousands of organisations worldwide, from government agencies to defence contractors to international charities. A Russian-linked cyber-espionage group known as Laundry Bear has been exploiting a security flaw in the software since July 2025 to break into accounts and steal sensitive information. The vulnerability is particularly serious because people can become infected simply by reading a malicious email, without needing to click anything or download anything.
The attackers have stolen massive amounts of sensitive data including months of email messages, login credentials, staff directories and security tokens that would normally prevent unauthorised access. The attacks have affected organisations across defence, government, education, energy, law enforcement, media, charities and technology sectors. Some victims have been compromised for up to 90 days, allowing attackers to gather very large quantities of data.
This campaign matters because the affected software is so widely used by important organisations across the world, meaning a single vulnerability could compromise vast quantities of government, commercial and humanitarian data. Twenty-seven international agencies have worked together to alert organisations and recommend urgent software updates. Organisations are advised to limit their use of the web-based version of Zimbra until security patches are fully installed.
Cybersecurity Europe Technology World