Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite
Russian state-sponsored actors exploit Zimbra Collaboration Suite via zero-day vulnerability.
Russian state-sponsored APT group LAUNDRY BEAR is targeting organizations using Zimbra Collaboration Suite (ZCS) with a novel exploit for CVE-2025-66376. This zero-day vulnerability, patched in November 2025, allows attackers to exfiltrate emails, the Global Address List, and other sensitive data by simply viewing a malicious email. The campaign, active since July 2025, aims to gather intelligence for the Russian Federation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Zimbra Collaboration Suite?
Get an email when a new story names Zimbra Collaboration Suite, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonLAUNDRY BEAR exploited CVE-2025-66376, a zero-day in Zimbra Collaboration Suite, to exfiltrate emails and sensitive directory data simply by having a victim view a malicious email — requiring no clicks or interaction. The root failure was the window between vulnerability disclosure and organizational patching, compounded by reliance on email platforms without compensating controls. Because Zimbra is widely used by government and critical infrastructure organizations, this campaign offered high-value intelligence collection at scale. State-sponsored actors routinely weaponize zero-days before patches are widely deployed, making rapid patch adoption and layered defenses essential. The passive nature of the exploit (view-only trigger) underscores that even cautious users cannot protect themselves without timely vendor patches being applied.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2025-66376
- domain — zmailanalytics[.]com
- domain — zimbra-metadata[.]com
- domain — analyticemailmeter[.]com
- domain — emailanalytics.com[.]ua
- domain — mailnalysis[.]com
- domain — zimbrastat[.]com
- domain — zimbrasoft.com[.]ua
- domain — synacorzimbra[.]nl
- domain — istc-cloud[.]com
- email — ivanka.zurabishvili@proton[.]me
- email — zmul1@buildandconsulting[.]com
- email — garrysmithme@pinmx[.]net
- email — hostingclient@pinmx[.]net
- email — c.laurent.ejfa@proton[.]me
- email — j.moreau.epsc@proton[.]me
- email — liberty.insights@proton[.]me
- domain — isofts.kiev[.]ua
- domain — navs.edu[.]ua
- hash_sha256 — 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf
- hash_sha256 — 60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874
- hash_sha256 — b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d
- hash_sha256 — 1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760
- ip — 216.252.238[.]104
- ip — 216.252.238[.]18
- ip — 37.120.247[.]228
- ip — 185.86.79[.]95
- ip — 104.248.134[.]194
- ip — 64.226.124[.]190
- ip — 193.238.152[.]66
- ip — 216.252.238[.]64
- ip — 194.156.103[.]193