Zero-Click Exploits Hit Zimbra Users

A silent and persistent intrusion campaign has compromised government and commercial networks for over a year, utilizing an unconventional delivery method that bypasses the need for clicks or file downloads. By leveraging a specific vulnerability in web-based collaboration tools, the attackers have successfully exfiltrated vast quantities of internal data without alerting their targets.

Weaponizing Email Previews

The campaign centers on the exploitation of CVE-2025-66376, a cross-site scripting (XSS) vulnerability found within the Zimbra Collaboration Suite. Unlike traditional phishing attempts that rely on deceptive links or malicious attachments to entice a user, this method executes malicious JavaScript as soon as the email is viewed. This allows for near-instant access to the user's environment.

Intelligence from a coalition of 27 international government agencies identifies the actors behind these intrusions as Laundry Bear, also known as Void Blizzard. These actors have been active since at least July 2025, focusing their efforts on the covert acquisition of sensitive email data.

Tactical Data Exfiltration

Once the initial trigger occurs upon viewing, the malicious payload initiates an extensive data harvesting process. The attackers systematically scrape a variety of sensitive assets, including:

• The previous 90 days of email communications.
• Account passwords and two-factor authentication tokens.
• Global address lists and organizational directories.
• Newly generated application-specific passcodes.

The stolen information is subsequently offloaded to an unattributable virtual private server, where the group utilizes a proprietary framework referred to as Flowerbed. This Python-based tool, which leverages containerization, appears to have incorporated AI-generated code during its development phase.

“Laundry Bear’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data,”

— The joint security alert

Strategic Implications for Security

This incident underscores a significant evolution in how threat actors leverage email-based vectors. By shifting the point of compromise to the automated rendering of emails, attackers effectively remove the human element—such as link-clicking or suspicion-based dismissal—that security training programs typically aim to address. Organizations relying on web-based mail clients should prioritize the application of patches to remediate CVE-2025-66376, as the persistence of these actors suggests they will continue to exploit unpatched infrastructure to maintain their foothold in high-value sectors like defense and energy.