Russian Hackers Exploit Zero-Click Vulnerability in Zimbra Email Software

Since mid-2025, a Russian state-backed hacking group known as Laundry Bear has exploited a zero-click vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite to steal sensitive data from NATO agencies and other organizations. This attack method allows hackers to access email accounts without requiring victims to click links or open attachments, merely by viewing the malicious email. The campaign has targeted various sectors, including defense, government, and education, successfully compromising over 10 organizations. U.S. and allied cyber agencies issued a joint advisory on July 23, 2026, urging organizations to patch their Zimbra installations to mitigate the risk. The vulnerability was publicly disclosed in January 2026 but had been actively exploited for months prior. Affected systems include unpatched versions of Zimbra Collaboration Suite, which is widely used across multiple sectors. The attack's covert nature and the absence of financial extortion indicate its espionage objectives.

Key Points: • Laundry Bear exploits a zero-click vulnerability in Zimbra to steal sensitive data. • The attack requires only the victim to view a malicious email, with no user interaction needed. • U.S. and allied agencies have issued urgent advisories for organizations to patch Zimbra software.