Back Itnews.Au

US and allies say Russian hackers stole emails without social engineering

Itnews.Au • July 23, 2026

The United States and more ⁠than a ⁠dozen allied nations said that Russian hackers stole emails from users of the Zimbra email program without having to fool them into opening an attachment or ‌clicking a link.

The trick, which cyber security firm Proofpoint ‌described ‌as a "half-click exploit," leveraged a now-patched ‌weakness in Zimbra software that allowed a ⁠hacker to compromise it after a user simply opened an email.

"No social engineering required," Proofpoint said in a blog post outlining the hacking campaign.

In a 31-page alert the hacking, police and intelligence agencies from the US, the Netherlands, Canada, Britain, Australia, New Zealand, Denmark, the Czech ⁠Republic and other European nations blamed what they said was a Russian government-supported hacking group Laundry Bear for the spy campaign.

They said the campaign heavily targeted Ukraine before hitting users in the US and other members of the NATO military alliance.

"It’s particularly concerning that these thugs tested their methods on victims in Ukraine, before targeting members of NATO," British security minister Dan Jarvis said in a ⁠statement.

Laundry Bear is one of several hacking groups ⁠the US alleges are working for Russian security services.

A US indictment filed this month tied the group to a Russian cyber security company called ‌Yutek-NN, whose ⁠deputy director, Denis Obrezko, faces hacking-related charges in Boston following his arrest in Thailand last year. He has pleaded not guilty.

The Russian embassy in Washington ‌did not immediately respond to a request for . Yutek-NN has not responded to repeated requests for .

Moscow typically denies participating in hacking campaigns.

Zimbra and its owner, Buffalo, New York-based Synacor, could not be immediately reached for .

Like other digital intelligence gatherers, Russian cyber spies routinely target email services.

In April, Reuters reported Russian hackers ‌had broken ⁠into scores of email accounts belonging to prosecutors and investigators across Ukraine.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign Since July 2025, Russian state-backed hackers, known as Laundry Bear, have exploited a zero-click vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite to infiltrate Western government and commercial organizations. This attack method allows hackers to steal sensitive data without requiring victims to click links or open attachments, merely by opening or previewing an email. The campaign has targeted over ten organizations, including those in the defense, energy, and technology sectors, with a focus on NATO countries and Ukraine. The vulnerability was patched in November 2025, but many systems remain unpatched. Cybersecurity agencies from the US and allied nations have issued urgent advisories to mitigate the threat. The attacks have been linked to espionage activities aimed at gathering intelligence for the Russian government. 82 sources 81

Extracted Entities

US and allies say Russian hackers stole emails without social engineering

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (3)

Countries (7)

MITRE ATT&CK (1)