Back Ncsc.Uk

UK and partners expose Russian state-supported actors for new ‘zero-click’ phishing campaign targeting Western organisations

Ncsc.Uk • July 23, 2026

GCHQ’s National Cyber Security Centre and international partners issue warning as ‘LAUNDRY BEAR’ cyber threat group exposed for targeted phishing campaign

Free online tool from the NCSC prevents cyber criminals using your email to conduct cyber attacks.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign Since July 2025, Russian state-backed hackers, known as Laundry Bear, have exploited a zero-click vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite to infiltrate Western government and commercial organizations. This attack method allows hackers to steal sensitive data without requiring victims to click links or open attachments, merely by opening or previewing an email. The campaign has targeted over ten organizations, including those in the defense, energy, and technology sectors, with a focus on NATO countries and Ukraine. The vulnerability was patched in November 2025, but many systems remain unpatched. Cybersecurity agencies from the US and allied nations have issued urgent advisories to mitigate the threat. The attacks have been linked to espionage activities aimed at gathering intelligence for the Russian government. 47 sources 81

Extracted Entities

UK and partners expose Russian state-supported actors for new ‘zero-click’ phishing campaign targeting Western organisations

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (1)