Russian Hackers Exploit Zimbra Zero-Day for Email Theft

• •Laundry Bear exploits CVE-2025-66376, a zero-day vulnerability in Zimbra.
• •The attack targets sensitive email data from various sectors, including defense and government.
• •CISA has confirmed active exploitation, urging organizations to patch their systems immediately.

Russian state-sponsored hacking group Laundry Bear has been exploiting a zero-day vulnerability in the Zimbra Collaboration Suite, tracked as CVE-2025-66376, since at least July 2025. This stored cross-site scripting (XSS) flaw allows attackers to execute malicious JavaScript when victims view crafted emails, enabling the theft of sensitive information such as the last 90 days of emails, passwords, and two-factor authentication tokens. The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that the group targets organizations across various sectors, including defense, government, and education. The vulnerability was patched in November 2025, but many organizations remain unpatched and vulnerable. The attacks are characterized by a lack of financial motivation, focusing instead on maintaining persistent access to email accounts. Authorities have issued advisories urging immediate patching of affected systems to mitigate risks.