CVE-2025-66376: Detect and Contain LAUNDRY BEAR in Zimbra

by

Exploitation Overview: Russian APT LAUNDRY BEAR Targets Zimbra Webmail

A joint cybersecurity advisory released by CISA, NSA, FBI, and international intelligence partners details ongoing espionage campaigns by Russian state-supported threat actor LAUNDRY BEAR (also tracked as Void Blizzard, TA488, and CL-STA-1114). Operating since at least July 2025, the group actively targets Zimbra Collaboration Suite (ZCS) webmail servers across Western government entities, Defense Industrial Base (DIB) organizations, education, energy, and technology sectors.

The campaign utilizes a custom data exfiltration framework named Ulej (Russian for beehive) to exploit CVE-2025-66376, a cross-site scripting (XSS) vulnerability caused by improper input neutralization of CSS @import directives in ZCS. Originally exploited as a zero-day before vendor patching in November 2025 and public disclosures in January 2026, the exploit enables adversary access to sensitive mailbox data, authentication credentials, and organizational directories.

Critical Warning: Unlike conventional phishing attacks that require user interaction such as link-clicking or file execution, this exploit utilizes a view-based payload. Simply rendering a malicious email in a vulnerable ZCS webmail interface triggers automated script execution and full mailbox compromise.

Technical Analysis: Ulej Capability and Execution Flow

The initial compromise payload arrives embedded within an email rendered in ZCS webmail. The malicious email contains an inline Scalable Vector Graphics (SVG) element housing a Base64-encoded outer payload in its onload attribute, following CSS @import directives designed to trigger CVE-2025-66376. The outer script decodes and decrypts an inner XOR-encrypted JavaScript file containing the main execution logic. Once executed within the victim’s authenticated web session, the Ulej capability conducts automated collection and exfiltration across twelve asynchronous stages:

  1. sendStartPing: Issues an initial HTTPS POST ping to actor C2 infrastructure signaling successful payload detonation.
  2. gather_email: Extracts the victim’s email address by parsing internal batchInfoResponse structures or sending a SOAP GetIdentitiesRequest under the zimbraAccount namespace.
  3. gather_environment: Inspects active URL parameters to identify the webmail client interface type (Advanced, Standard, or Modern) and queries exact ZCS server versions.
  4. gather_2fa_codes: Issues a SOAP GetScratchCodesRequest to capture backup multi-factor authentication (MFA) recovery tokens.
  5. gather_app_password: Sends a SOAP CreateAppSpecificPasswordRequest to generate a new Application Passcode explicitly named “ZimbraWeb”.
  6. gather_device_status: Queries active mobile sync devices associated with the account via SOAP GetDeviceStatusRequest under the zimbraSync namespace.
  7. gather_oauth_consumers: Enumerates connected OAuth applications using SOAP GetOAuthConsumersRequest.
  8. gather_autocomplete_password: Dynamically injects two off-screen HTML login <div> elements into the DOM and waits five seconds to extract credentials populated automatically by browser password managers.
  9. enable_mail_protocols: Issues a SOAP ModifyPrefsRequest setting the zimbraPrefImapEnabled preference to TRUE, establishing backdoor IMAP access.
  10. gather_gal: Conducts brute-force harvesting of the Global Address List (GAL) by dispatching 20 batches of SOAP SearchGalRequest calls covering alphanumeric character combinations.
  11. sendArchives: Downloads non-junk emails received or sent over the preceding 90 days via HTTP GET queries (/home/~/?fmt=tgz&meta=0&query=date:-{DAY_OFFSET}d AND (not in:junk)) and packages them into GZIP compressed archives for exfiltration.
  12. sendFinishPing: Sends a final telemetry beacon confirming successful execution and data transfer.

Infrastructure and C2 Command Protocol

Data harvested by Ulej is exfiltrated to actor-controlled Virtual Private Servers (VPS) hosting the Flowerbed collection framework. Flowerbed operates as a containerized Docker deployment consisting of four specific components:

  • Catcher: Acts as the dual HTTP (port 8000) and DNS (port 53) ingest engine for exfiltrated payloads.
  • Nginx: Operates as an HTTPS reverse proxy with strict Server Name Indication (SNI) filtering, discarding non-Ulej connections missing the *.i.* domain substring with HTTP 444 responses.
  • Certbot: Automates TLS certificate issuance via Let’s Encrypt DNS challenges using Cloudflare integrations.
  • Gardener: Monitors service health and data ingestion pipelines inside the containerized cluster.

Exfiltration occurs concurrently over dual channels. For DNS egress, Ulej formats data into Base32 subdomains compliant with RFC 1035, dispatching A-record lookups formatted as d-<victim_id>.<datatype>.<c2_domain>. For HTTPS egress, data is submitted via POST endpoints to /v/p for JSON payloads or /v/d using binary stream encodings with custom X-Filename headers (e.g., telemetryData_{0-89}.json).

Forensic Identification and Artifact Hunting

Security operations centers (SOC) and incident response teams can search for persistent post-compromise indicators across mail logs, endpoint storage, and system settings:

Mailbox Log Analysis

Inspect Zimbra mailbox logs located at /opt/zimbra/log/mailbox.log for abnormal spikes in SOAP requests originated from web sessions. Key forensic search queries include:

  • High-frequency SearchGalRequest calls executed in rapid succession by single accounts.
  • Executions of CreateAppSpecificPasswordRequest specifying ZimbraWeb as the application name.
  • Unusual invocation of GetScratchCodesRequest or ModifyPrefsRequest altering zimbraPrefImapEnabled settings.

Endpoint LocalStorage Inspection

Ulej writes persistence variables to browser localStorage on client workstations to track exfiltrated dates. Query endpoint browser storage under the ZCS webmail origin for keys matching the format zd_comp_YYYY-MM-DD. The presence of these entries confirms historical script execution and email exfiltration.

Mitigation and Incident Remediation Plan

Organizations operating Zimbra Collaboration Suite must immediately take defensive action:

  • Apply Software Patches: Immediately upgrade ZCS to patched release versions 10.1.13 or 10.0.18.
  • Restrict Webmail Interface Access: If patching cannot be completed immediately, mandate alternative mail clients and restrict user access to the Classic ZCS webmail portal.
  • Revoke Backdoor Authentication Keys: Audit all user accounts and revoke all Application Passcodes (specifically targeting entries labeled “ZimbraWeb”) along with existing 2FA scratch recovery keys.
  • Enforce Account Password Resets: Mandate organization-wide password resets for impacted users, accounting for potential compromise of credentials saved within browser password managers.
  • Implement Network Egress Filtering: Block outbound communication to known C2 infrastructure and inspect TLS connections for suspicious traffic matching Ulej URI patterns (/v/p and /v/d).

Verification Checklist

  • Zimbra Collaboration Suite instances updated to version 10.1.13 or 10.0.18 or higher.
  • /opt/zimbra/log/mailbox.log audited for CreateAppSpecificPasswordRequest and SearchGalRequest anomalies.
  • Application passcodes named “ZimbraWeb” identified and revoked enterprise-wide.
  • 2FA scratch codes generated or accessed during the compromise window reset.
  • Browser localStorage checked for zd_comp_YYYY-MM-DD keys on suspect user endpoints.
  • Network egress traffic monitored for unauthorized DNS subdomains and POST requests to C2 URIs.

Source

For complete advisory documentation, indicator listings, and STIX data feeds, refer to the official CISA advisory: CISA Advisory AA26-204A: Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite.