LAUNDRY BEAR Exploits Zimbra CVE-2025-66376 in Cyber Espionage Campaign

by

Executive Summary & Vulnerability Context

A joint cybersecurity advisory released by CISA, the NSA, FBI, and international intelligence partners warns of an ongoing cyber espionage campaign by Russian state-supported threat group LAUNDRY BEAR (also tracked as Void Blizzard, TA488, and CL-STA-1114). Since at least July 2025, the group has targeted Western government agencies, Defense Industrial Base (DIB) contractors, energy providers, educational institutions, and technology firms utilizing Zimbra Collaboration Suite (ZCS).

The campaign leverages a cross-site scripting (XSS) vulnerability, tracked as CVE-2025-66376 (CWE-79), caused by improper sanitization of Cascading Style Sheet (CSS) @import directives in the ZCS webmail interface. Initially exploited as a zero-day flaw prior to vendor patch availability in November 2025, CVE-2025-66376 allows an attacker to execute arbitrary JavaScript within a target's webmail session. Vendors released patches for ZCS versions 10.1.13 and 10.0.18 to address the vulnerability.

Critical Advisory: The initial execution vector requires no user interaction beyond viewing a malicious email in the ZCS webmail client. Merely opening or previewing the message triggers full mailbox exfiltration and account manipulation.

Campaign Mechanics and Initial Access

LAUNDRY BEAR initially relied on credential theft via adversary-in-the-middle (AiTM) phishing tools like Evilginx2 and password spraying. In mid-2025, the group transitioned to exploiting CVE-2025-66376 using a custom data exfiltration framework named Ulej ("Beehive" in Russian). The threat actors deliver phishing messages containing Scalable Vector Graphics (SVG) elements with Base64-encoded and XOR-encrypted inner JavaScript payloads. To evade signature-based detection, the payload uses dynamic XOR keys and non-functional CSS @import padding directives.

Initial distribution relied on ProtonMail accounts. Recent campaigns show the actors distributing malicious emails directly through previously compromised organizational accounts, including domains such as isofts.kiev.ua and navs.edu.ua, bypassing basic domain reputation checks.

Technical Analysis: Ulej Payload Execution Stages

Upon rendering the malicious email, the decoded JavaScript payload automatically initiates account profiling, persistence installation, credential harvesting, and email exfiltration across twelve asynchronous stages:

  1. sendStartPing: Transmits an initial execution HTTP POST notification to actor-controlled C2 infrastructure.
  2. gather_email: Extracts the target's email address from page variables or via a SOAP GetIdentitiesRequest call using the session's Cross-Site Request Forgery (CSRF) token.
  3. gather_environment: Inspects the active webmail client path to fingerprint the client interface variant (Advanced, Standard, or Modern) and software build version.
  4. gather_2fa_codes: Executes a SOAP GetScratchCodesRequest under the zimbraAccount namespace to harvest multi-factor authentication recovery codes.
  5. gather_app_password: Issues a SOAP CreateAppSpecificPasswordRequest to generate a persistent Application Passcode named ZimbraWeb.
  6. gather_device_status: Executes a SOAP GetDeviceStatusRequest to gather active synchronization and mobile device profiles.
  7. gather_oauth_consumers: Issues a SOAP GetOAuthConsumersRequest to collect linked third-party OAuth integrations.
  8. gather_autocomplete_password: Injects hidden HTML form elements outside the browser viewport to trigger browser-based password manager auto-completion, harvesting saved credentials after a five-second delay.
  9. enable_mail_protocols: Sends a SOAP ModifyPrefsRequest setting zimbraPrefImapEnabled to TRUE, ensuring active IMAP access for long-term collection.
  10. gather_gal: Brute-forces the organization's Global Address List (GAL) using 20 batched queries containing 77 SOAP SearchGalRequest commands.
  11. sendArchives: Downloads non-junk email messages from the preceding 90 days via HTTP GET requests using format string /home/~/?fmt=tgz&meta=0&query=date:-{DAY_OFFSET}d AND (not in:junk), compresses them into GZIP archives, and exfiltrates them. Marks completed days in window.top.localStorage under zd_comp_YYYY-MM-DD to avoid duplicate exfiltration.
  12. sendFinishPing: Transmits a final execution status payload confirming task completion.

C2 Infrastructure and Flowerbed Framework

Exfiltrated data is routed to a custom operational container framework called Flowerbed, deployed on short-lived Virtual Private Servers (VPS) sourced via privacy-focused providers and routed through Mullvad VPN. Flowerbed consists of four Docker containers:

  • Nginx: Functions as an HTTPS reverse proxy enforcing TLS encryption via Let's Encrypt certificates. It validates that the TLS Server Name Indication (SNI) header contains *.i.*, returning HTTP status 444 to non-qualifying requests to prevent scanning.
  • Catcher: Operates as the C2 ingress receiver, listening on HTTP port 8000 and DNS port 53. Collects exfiltrated data, saving HTTPS payloads and DNS A-record queries into local storage directories (/root/hits/tmp and /root/hits/ready).
  • Certbot: Manages automated domain certificate issuance using Cloudflare DNS-01 challenges.
  • Gardener: A Python monitoring script validating health and file processing within Catcher.

Automated SSH workflows connect to Flowerbed every 60 seconds to pull harvested data into non-public operational repositories, while an hourly job purges files modified more than two days prior.

Detection and Threat Hunting

Security operations teams should inspect endpoint, server, and network logs for artifacts left by the Ulej framework:

Server Log Inspection

Analyze Zimbra mailbox logs located at /opt/zimbra/log/mailbox.log for abnormal spikes in SOAP API activity originate from user web sessions. High-risk indicators include rapid bursts of SearchGalRequest, repeated invocations of GetScratchCodesRequest, and CreateAppSpecificPasswordRequest calls creating applications named ZimbraWeb.

Endpoint Forensic Analysis

Inspect client browser local storage (window.top.localStorage) for the presence of keys matching the pattern zd_comp_YYYY-MM-DD. The existence of these keys confirms execution of the exfiltration script and identifies the specific email dates stolen.

Network Indicators

Monitor outbound DNS queries for subdomains prefixed with d- containing high-entropy Base32 strings formatted to sub-63-character RFC 1035 limits. Inspect proxy logs for HTTPS POST requests directed to /v/p and /v/d paths bearing custom X-Filename headers such as zimbra_batch_analytics.json or telemetryData_*.json.

Remediation and Defensive Guidance

To eliminate vulnerability exposure and remediate potential compromise, organizations running Zimbra Collaboration Suite must execute the following controls immediately:

  • Apply Vendor Updates: Upgrade ZCS instances to patched release versions 10.1.13, 10.0.18, or higher to neutralize CVE-2025-66376.
  • Restrict Webmail Access: If immediate patching cannot be executed, restrict access to the ZCS Classic webmail portal and mandate the use of dedicated desktop or mobile IMAP/SMTPS clients.
  • Revoke Authentication Credentials: Revoke all active ZCS Application Passcodes organization-wide, specifically targeting passcodes named ZimbraWeb. Invalidate all 2FA scratch keys and enforce mandatory user password resets.
  • Quarantine Phishing Indicators: Search email gateways and user mailboxes for messages containing SVG attachments or embedded CSS @import rules originating from suspicious sender addresses or known compromised domains.

Verification Checklist

  • Confirmed ZCS production server build is running version 10.1.13, 10.0.18, or newer.
  • Audited /opt/zimbra/log/mailbox.log for unauthorized SOAP requests and confirmed absence of CreateAppSpecificPasswordRequest entries named ZimbraWeb.
  • Scanned organization webmail sessions and endpoint browser storage for zd_comp_ storage entries.
  • Verified revocation of active 2FA scratch keys and Application Passcodes for affected user accounts.
  • Configured network egress rules and DNS logging to alert on subdomains using Flowerbed C2 patterns or known IOC domains.

Source

For complete details, technical appendixes, and downloadable STIX indicators, refer to the canonical advisory published by CISA: CISA Advisory AA26-204A: Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite.