Russian state-supported hackers are targeting organizations with a new attack technique using a Zero-Click method which doesn’t require users to interact with the phishing email.
The campaign is designed to compromise networks and gain persistent access, a joint advisory from western cyber intelligence agencies has warned.
Issued on July 23, the alert warned that state-backed threat actors working on behalf of Russia have been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025.
Organizations known to be targeted by these espionage attacks have been identified in the defense, government, education, energy, law enforcement, media, NGO and technology sectors.
The joint advisory has been issued by the UK National Cyber Security Centre, US agencies including Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency and the FBI, along with cyber and intelligence agencies from the other Five Eyes nations (Canada, Australia and New Zealand), as well as European agencies.
The campaign has been attributed to cyber espionage operation which has been linked to Russia dubbed Laundry Bear, also known as Void Blizzard and UAC-0190.
The Laundry Bear campaign exploits a zero-day vulnerability in ZCS (CVE-2025-66376) which was publicly disclosed in November 2025 and uses a zero-click exploit coined “beehive” to steal emails and other sensitive data.
Unlike traditional phishing campaigns which require a user to be socially engineered into taking an action, such as clicking a link or opening a file, the Laundry Bear campaign leverages the vulnerability to exploit a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service.
If the exploit is successful, the attackers look to exfiltrate at least the last 90 days of emails from the server, as well as other sensitive information. Laundry Bear also attempts to maintain persistence on the network of the compromised victim by secretly stealing passwords and circumvent multi-factor authentication protections through session tokens.
Organizations which use ZCS have been urged to take immediate action to patch the critical vulnerabilities and improve their network monitoring capabilities.
“This phishing campaign demonstrates how hostile actors will ruthlessly adapt techniques and exploit vulnerable technology in pursuit of their aims to steal sensitive information from Western organizations,” said Beth Hopkins, COO of the NCSC.
“With our international partners, we strongly encourage organizations to familiarize themselves with the ‘zero-click’ techniques described in the advisory which could be used against other platforms, and act on the mitigation advice,” she added.
In addition to immediately patching vulnerability, system administrators have been advised to be on the lookout for suspicious activity.
The advisory also recommends that organizations should consider using a third-party authentication service that supports passkeys for authentication to mediate access to ZCS and other services that do not natively support passkeys. Doing this can help eliminate the possibility of threat actors exploiting stolen credentials to access servers.
The alert also warned that technical analysis of the campaign indicated that AI played a role in the development of a simple codebase for the operation. This comes after intelligence agencies have warned about how malicious threat actors could harness AI in their campaigns.
