Laundry Bear APT Exploits Zimbra Zero-Day to Steal Passwords and 2FA Codes

On July 23, 2026, a joint cybersecurity advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and international defense partners—including the Dutch General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD)—issued a stark warning to enterprise system administrators. A prominent Russian state-sponsored advanced persistent threat (APT) group known as Laundry Bear (also tracked as TA488 and Void Blizzard) has been actively executing a high-impact, stealthy cyber espionage campaign against Western governments, defense industrial base partners, and commercial entities. By weaponizing a zero-click, stored cross-site scripting (XSS) vulnerability within the Zimbra Collaboration Suite (ZCS), the actors have systematically compromised webmail servers, exfiltrating vast troves of sensitive communications, internal directories, browser-stored passwords, and two-factor authentication (2FA) recovery codes.

Historically recognized for relying on conventional credential harvesting techniques such as password spraying, spear-phishing, and cookie theft, Laundry Bear has dramatically elevated its technical operational tradecraft. The deployment of a sophisticated “half-click” or “view-based” zero-day exploit demonstrates an evolving doctrine aimed at bypassing perimeter defenses and established secure email gateways. For enterprise cybersecurity leadership, this campaign underscores a critical operational reality: applying a software security patch closes the vulnerability window, but it does absolutely nothing to invalidate credentials, session tokens, or authentication keys that adversaries have already systematically harvested.

Anatomy of CVE-2025-66376: How Laundry Bear Weaponized Zimbra Classic UI

The core vector driving this espionage campaign is tracked under Common Vulnerabilities and Exposures as CVE-2025-66376, a critical stored cross-site scripting vulnerability affecting the Classic User Interface (UI) of the Zimbra Collaboration Suite. Zimbra is widely adopted across government agencies, defense contractors, and telecommunications providers worldwide due to its Linux-based, open-core enterprise architecture. However, legacy webmail interfaces often struggle with comprehensive sanitization of incoming complex HTML email payloads.

Traditional phishing campaigns require a human target to perform a definitive action—such as clicking a malicious URL, enabling macros, or entering credentials into a spoofed login page. In contrast, CVE-2025-66376 functions as a view-based (half-click) exploit. The moment an authenticated user simply selects or previews a specially crafted HTML email within Zimbra’s Classic UI, the vulnerability triggers automatically without requiring any further interaction, file download, or secondary link navigation.

Mechanism of Exploitation

The technical mechanics behind the vulnerability involve flawed input sanitization mechanisms within Zimbra’s email rendering engine. The payload is embedded directly into the body structure of an incoming MIME-formatted email:

• Payload Injection: Laundry Bear crafts malicious HTML structures containing obfuscated JavaScript tags embedded within allowed style attributes or customized XML/CSS elements.
• Engine Bypass: Zimbra’s backend sanitizer fails to strip or sanitize specific malformed script constructs before passing the raw HTML to the client browser’s Document Object Model (DOM).
• DOM Execution Context: When the victim opens the message, the web browser parses the unsanitized HTML inside the trusted origin domain of the Zimbra server (e.g., https://mail.organization.com).
• Session Inheritance: Because the JavaScript executes directly within the active webmail origin context, the browser automatically attaches all active session cookies, ambient HTTP tokens, and authorization headers to background API requests initiated by the script.

This origin-level execution grants the adversary complete administrative privilege over the target user’s current webmail session, operating entirely below the visibility of network firewalls, perimeter email inspection tools, and standard desktop Endpoint Detection and Response (EDR) agents.

Data Exfiltration and Stealth Tactics: From Emails to 2FA Recovery Codes

Once the malicious JavaScript payload gains execution authority within the target’s browser, it initiates an automated exfiltration sequence designed to extract maximum strategic intelligence while leaving a minimal forensic footprint. Threat intelligence reports from CISA, Proofpoint, and Palo Alto Networks Unit 42 reveal a multi-stage exfiltration architecture.

Comprehensive Exfiltration Capabilities

The malicious script queries Zimbra’s internal SOAP and REST API endpoints directly from the victim’s browser, enabling the automated extraction of high-value assets:

1. Historical Email Harvesting: The payload queries webmail folders to pull up to 90 days of stored email communications, focusing on inbox contents, sent items, draft correspondence, and confidential attachments.
2. Global Address List (GAL) Enumeration: The script fetches the enterprise global email directory, scraping internal employee names, titles, direct phone numbers, operational roles, and organizational reporting structures to facilitate secondary spear-phishing or lateral movement.
3. Credential Infiltration: The script actively scans the client environment for browser-saved passwords, auto-filled form inputs, and newly entered login credentials within active webmail sessions.
4. Multi-Factor Authentication (MFA) Compromise: Crucially, the payload searches user profile settings and account preferences to capture 2FA recovery backup codes, TOTP secret tokens, and secondary verification parameters. This allows the threat actors to bypass multi-factor authentication controls during future direct login attempts.

Browser Storage Hijacking and Long-Term Persistence

Beyond immediate data theft, Laundry Bear engineered a persistent foothold designed to survive session timeouts and browser restarts. The payload writes malicious tracking scripts and session parameters directly into the browser’s persistent HTML5 localStorage object.

By hijacking localStorage, the adversary ensures that whenever the target re-authenticates to the webmail platform from that specific browser, the malicious script re-instantiates itself. It continuously exfiltrates newly received messages, updated directory objects, and refreshed authentication tokens to adversary-controlled Command and Control (C2) servers via encrypted HTTPS POST requests. Because these outbound calls originate from a legitimate browser session directed toward trusted cloud infrastructure, traditional Network Intrusion Detection Systems (NIDS) fail to trigger alerts.

Geopolitical Context and the Ukrainian “Testbench” Strategy

The Joint Cybersecurity Advisory highlights significant intelligence details regarding the operational methodology and strategic motivations of Laundry Bear. Tracked as TA488 or Void Blizzard, the group acts in direct support of foreign intelligence objectives for the Russian Federation.

Threat researchers at Proofpoint and government intelligence agencies noted a distinct geographical progression in the threat actor’s targeting vector:

• The Ukrainian Operational Testbed: Prior to launching wide-scale attacks against Western targets, Laundry Bear conducted extensive zero-day exploitation campaigns against Ukrainian governmental, military, and energy sector entities starting in mid-2025. Russian threat groups frequently utilize Ukrainian defense networks as both priority intelligence targets and technical “testbenches” to validate novel zero-day exploits before deploying them in global espionage operations.
• Global Strategic Expansion: Following initial field testing, the adversary scaled the campaign across NATO member states, targeting government ministries, the Defense Industrial Base (DIB), scientific research institutions, financial networks, and critical transport infrastructure across the United States, Europe, and the Indo-Pacific.
• Absence of Extortion: CISA noted that across all documented intrusions, there was zero evidence of ransomware deployment, financial extortion, or intentional data destruction. The single-minded operational focus remained strictly on silent, long-term intelligence gathering and strategic surveillance.

Defensive Blueprint: Remediation Beyond Software Patching

While Zimbra released official patches for CVE-2025-66376 in November 2025, security authorities emphasize that thousands of self-hosted enterprise mail servers remain unpatched or improperly configured. More importantly, for organizations that were targeted prior to applying the security patch, updating the underlying software solves only half of the security equation. Applying a software update patches the code vulnerability but leaves previously stolen session cookies, compromised 2FA backup codes, and harvested passwords fully valid for adversary exploitation.

Security teams must execute a comprehensive post-exploitation triage and hardening strategy across three core technical domains:

1. Immediate Session Invalidation and Credential Rotation

To eliminate ongoing persistent access gained through hijacked session states or stolen authentication material, administrators must immediately execute the following actions across all Zimbra webmail deployments:

1. Global Web Session Teardown: Force an enterprise-wide invalidation of all active user web sessions within the Zimbra administration console to terminate any active cookies or hijacked session tokens currently utilized by C2 nodes.
2. Mandatory Credential Reset: Require an immediate password reset for all users, explicitly advising employees not to re-use passwords that may have been saved in browser password managers.
3. Regeneration of 2FA Recovery Tokens: Purge and regenerate all multi-factor authentication backup codes, TOTP secrets, and secondary recovery tokens across the organization’s Identity Provider (IdP) and email services.
4. Purge Browser Storage: Instruct users to clear browser cache, cookies, and specifically persistent localStorage data to destroy any client-side JavaScript persistence mechanisms injected by the exploit.

2. Migration to Phishing-Resistant MFA

The compromise of session cookies and 2FA recovery codes by Laundry Bear highlights the fundamental vulnerability of legacy multi-factor authentication mechanisms. Basic SMS passcodes