# Year-long Russian attacks infect users as soon as they look at an email

- URL: https://talkfuse.com/story/year-long-russian-attacks-infect-users-as-soon-as-they-look-at-an-email/
- Published: 2026-07-23T16:47:02+00:00
- Updated: 2026-07-23T22:52:50+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/patches/2026/07/23/year-long-russian-attacks-infect-users-as-soon-as-they-look-at-an-email/5277358
- Topics: Cybersecurity, Europe, Technology, World

## Key points

- Russian-linked attackers exploited Zimbra emails viewed by victims.
- The campaign has run since July 2025.
- Organisations should apply patches and limit vulnerable webmail use.

## Summary

A Russia-linked cyber-espionage group known as Laundry Bear has reportedly exploited a vulnerability in Zimbra email software to compromise government and commercial organisations since July 2025. The attack is particularly serious because victims can be infected simply by viewing a malicious email, without clicking a link or opening an attachment, enabling attackers to steal sensitive communications and maintain access to accounts.

The campaign targets CVE-2025-66376, an XSS flaw patched in November 2025, and has affected organisations across defence, government, education, energy, law enforcement, media, NGOs and technology. A joint alert from 27 international agencies says attackers have taken up to 90 days of email, credentials, directories, two-factor authentication tokens and application passcodes, storing data through a custom framework called Flowerbed; agencies advise updating Zimbra and reducing use of its webmail client until patched.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.