CVE-2025-66376: Russian LAUNDRY BEAR Uses Zero-Click Zimbra XSS for Long-Running Espionage Against NATO Institutions

CVE-2025-66376 is stored XSS in Zimbra Collaboration Suite classic UI, used by Russian APT LAUNDRY BEAR for zero-click theft of Western government and defense mail. NSA, CISA, and allied agencies issued joint advisory AA26-204A.

Incident overview

On 23 July 2026, NSA, CISA, FBI, Dutch MIVD/AIVD, Canadian Cyber Centre, UK NCSC, and 20+ allied intelligence services issued joint advisory AA26-204A. Russian state APT LAUNDRY BEAR (also Void Blizzard, CL-STA-1114, TA488) has, since July 2025, exploited stored XSS CVE-2025-66376 in Zimbra Collaboration Suite (ZCS) classic UI against Western governments, Defense Industrial Base (DIB), law enforcement, technology, education, media, and NGOs. Near-year-long zero-click email espionage. First use was zero-day; unpatched ZCS instances remain an entry point.

Attackers used custom aggregator/exfil tool Ulej to steal ~90 days of mail, mail directories, user passwords, and 2FA scratch codes from compromised ZCS instances. June 2026: U.S. federal indictment of former FSB officer Denis Obrezko (on trial in Boston).

Technical details

Affected components

• Zimbra Collaboration Suite 10.0.17 and earlier (classic UI)
• Zimbra Collaboration Suite 10.1.12 and earlier (classic UI)
• Fixed in: 10.0.18 / 10.1.13 (released November 2025)
• CVE: CVE-2025-66376, CVSS 7.2, CWE-79 (stored XSS)
• Added to CISA KEV on 18 March 2026

How it works

CVE-2025-66376 is stored XSS in ZCS classic UI: insufficient sanitization of @import CSS directives and SVG/tag injection when rendering mail HTML. Attacker embeds a malicious SVG with a Base64 payload in the message body. Opening the mail in Zimbra Web classic UI executes the JavaScript in the authenticated session. No link click, no attachment download.

Exfiltrated data

Ulej collects and exfils from the victim browser:

• CSRF tokens: keep the session valid
• User mailbox addresses and passwords
• 2FA scratch codes: impersonation after password reset
• System and browser fingerprints
• ~90 days of mail and search history

2FA scratch-code theft matters: password reset alone does not evict the attacker. Revoke and regenerate all scratch codes; destroy all active sessions.

Attack infrastructure and IOCs

Ulej posts stolen data to a set of C2 servers. AA26-204A lists full IOCs (domains, URL patterns, mailbox addresses).

Impact assessment

ZCS is deployed by hundreds of thousands of government, military, and financial organizations worldwide. Awareness training does not help—compromise requires no victim action. Patch is the only reliable control. Once inside org mail, attackers can send internal phishing, steal credentials for other systems, harvest executive communications, and persist. Palo Alto Unit 42 (CL-STA-1114) reports LAUNDRY BEAR compromised at least 10 Western government/commercial orgs; actual count likely higher.

Remediation

Immediate actions

• Upgrade all ZCS instances to 10.0.18 / 10.1.13 or later
• Threat-hunt unpatched instances for communication with the AA26-204A IOC list
• Regenerate all 2FA scratch codes; destroy all active sessions and existing application passwords
• Force org-wide mailbox password reset; enforce MFA on ZCS

Mitigation and hardening

• Restrict ZCS outbound connections to required update sources and legitimate mail relays
• Block listed C2 domains/IPs at the perimeter
• Disable ZCS classic UI; migrate to modern UI (smaller XSS surface)
• Monitor ZCS logs for anomalous outbound sessions, especially bulk export of 90-day mail history
• Keep and exercise offline mail and directory backups for recovery during cleanup

References

• CISA AA26-204A joint advisory
• NSA joint alert
• Palo Alto Unit 42 CL-STA-1114 report