Russian state-sponsored hackers, identified as ‘Laundry Bear,’ have been actively exploiting a zero-day vulnerability in the Zimbra Collaboration Suite (ZCS) to infiltrate and extract sensitive information from organizations across NATO member countries. This campaign, which began in July 2025, has primarily targeted sectors such as government, defense, energy, education, media, NGOs, and technology.
The exploited vulnerability, designated as CVE-2025-66376, is a cross-site scripting flaw within ZCS webmail. The attackers employ a custom-developed tool named ‘Ulej’ (Russian for ‘beehive’) to execute their operations. Notably, this attack requires minimal user interaction; merely viewing a malicious email in a vulnerable Zimbra client can trigger the exploit, leading to unauthorized code execution.
Upon execution, the malicious JavaScript payload performs a series of automated actions to gather critical information from the victim’s account. This includes harvesting email addresses, device statuses, OAuth consumer details, and two-factor authentication (2FA) scratch codes. The script also enables IMAP access and generates a new Zimbra Application Passcode labeled ‘ZimbraWeb,’ granting the attackers persistent access that bypasses ZCS’s native 2FA protections.
To facilitate email exfiltration, the script systematically queries the mailbox for non-junk messages from the past 90 days. The collected data is then compressed and prepared for transfer through the Ulej framework to servers controlled by the attackers. This infrastructure, known as ‘Flowerbed,’ is a Python-based collection system designed to avoid redundant data collection. Notably, emails from the current day are consistently exfiltrated with each exploit execution.
The exfiltration process employs both HTTPS and DNS as covert transmission methods. For smaller data items, the malware encodes information in Base32 and triggers DNS lookups through specially crafted image URLs. Larger files, including email archives and Global Address List (GAL) contents, are transferred over HTTPS to the Flowerbed infrastructure, which utilizes Let’s Encrypt certificates and operates via an Nginx reverse proxy.
The Flowerbed setup employs Docker containers for various operational tasks, including HTTP/DNS exfiltration and health checks. It uses VPN services like Mullvad to obscure its activities. JSON logs and payload files are carefully staged for exfiltration, with automated purging of older files to maintain operational stealth.
According to a joint advisory from the National Security Agency (NSA) and its partners, evidence suggests that artificial intelligence tools were utilized in developing the Flowerbed codebase, highlighting a growing trend of threat actors leveraging AI to enhance their cyber operations.
This incident underscores the critical importance of promptly applying security patches and maintaining vigilant cybersecurity practices. Organizations using Zimbra Collaboration Suite are urged to update their systems immediately to mitigate the risk posed by this vulnerability. Additionally, implementing robust email security measures and conducting regular security audits can help detect and prevent such sophisticated attacks in the future.
