Back Securityaffairs.Co

US Agencies Warn of Laundry Bear Campaign Targeting Unpatched Zimbra Servers

Securityaffairs.Co •Pierluigi Paganini • July 24, 2026

US agencies warn Russian group Laundry Bear is exploiting a patched Zimbra flaw to steal email accounts from organizations running unpatched servers. The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI) and other U.S. government and international partners published a joint advisory to warn that the Russia-linked APT […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign Since July 2025, Russian state-backed hackers, known as Laundry Bear, have exploited a zero-click vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite to infiltrate Western government and commercial organizations. This attack method allows hackers to steal sensitive data without requiring victims to click links or open attachments, merely by opening or previewing an email. The campaign has targeted over ten organizations, including those in the defense, energy, and technology sectors, with a focus on NATO countries and Ukraine. The vulnerability was patched in November 2025, but many systems remain unpatched. Cybersecurity agencies from the US and allied nations have issued urgent advisories to mitigate the threat. The attacks have been linked to espionage activities aimed at gathering intelligence for the Russian government. 47 sources 81

Extracted Entities

US Agencies Warn of Laundry Bear Campaign Targeting Unpatched Zimbra Servers

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

MITRE ATT&CK (1)

Platforms (1)