12OCT

Zimbra preview leaks mail to Russia

2 min read

10:55UTC

CISA, the NSA and the FBI named Russian actor LAUNDRY BEAR behind a zero-click Zimbra flaw that reads 90 days of mail on a single preview, in an advisory fifteen agencies co-sealed.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

Fifteen nations named a Russian zero-click Zimbra exploit that fires on preview, beyond any awareness training.

CISA, the National Security Agency (NSA) and the FBI published joint advisory AA26-204A on Thursday 23 July, co-sealed by fifteen partner agencies including Britain's NCSC, France's ANSSI and the Dutch AIVD, naming Russian state-supported actor LAUNDRY BEAR behind a zero-click exploit of Zimbra Collaboration Suite (ZCS) webmail⁠¹.

Merely viewing a single email hands the actor the victim's last 90 days of mail and the organisation's Global Address List (GAL), the internal directory of every staff name and address. The chain abuses CVE-2025-66376, a Common Vulnerabilities and Exposures (CVE) flaw Zimbra patched in November 2025, so every still-exposed appliance has run eight months unpatched.

LAUNDRY BEAR, tracked elsewhere as Void Blizzard and CL-STA-1114, drew a Dutch intelligence attribution in May 2025 for password-spraying and pass-the-cookie theft against cloud email. The exploit now fires the moment a target previews the message, removing the human-error step that awareness training targets. The advisory warns it will pivot to other webmail platforms as ZCS patching climbs, so fixing the appliance closes only today's door.

Fifteen co-sealing agencies is an unusually broad coalition; the FSB Centre 16 router-hijacking advisory two weeks earlier carried eighteen, against the two to four names a routine attribution once bore. The advisory format is scaling to match the breadth of Western email systems inside the blast radius.

Deep Analysis

In plain English

Zimbra Collaboration Suite is email software that organisations run on their own servers instead of using a service like Gmail. A flaw in it, tracked as CVE-2025-66376, let attackers read someone's email just by having it appear in their inbox, without the victim clicking anything. A hacking group Western governments call LAUNDRY BEAR, working on behalf of Russia, used this flaw to read and copy emails from targets for up to three months at a time. On 23 July, 15 countries led by the US cyber agency CISA, the NSA and the FBI jointly published a warning naming LAUNDRY BEAR and explaining how the attack worked, so organisations still running unpatched Zimbra servers know to fix them immediately.

Deep Analysis

Root Causes

The zero-click chain depended on Zimbra's self-hosted deployment model: unlike SaaS webmail, patching CVE-2025-66376 required each organisation's own IT team to apply the fix, and CISA's figures show many did not for eight months after it shipped.

A second structural gap is verification lag: zero-click delivery meant victims had no phishing click or malicious attachment to alert defenders, so mail exfiltration could run for up to 90 days before detection tools built for user-triggered compromise caught the activity.

Escalation

The 15-agency signature count is itself an escalation signal: joint advisories of this scale are reserved for actors governments want publicly deterred, not merely technically documented.

What could happen next?

Meaning
A 15-agency joint attribution list signals Western governments shifting toward public, coordinated naming of Russian state-linked actors rather than quiet technical warnings.
Risk
Organisations still running unpatched Zimbra Collaboration Suite deployments remain exposed to the same zero-click chain until they apply the CVE-2025-66376 fix.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2020 SolarWinds compromise saw a Russian state-linked actor exploit trusted software to conduct mass intelligence collection across US federal agencies for months before discovery. LAUNDRY BEAR's zero-click Zimbra chain follows the same structural pattern: a Russian state-supported actor using a collaboration platform's own trust boundary to harvest mail at scale rather than forcing a noisy intrusion.

Counter-parallel: The 2023 MOVEit mass-exploitation campaign by Clop shows a different outcome for a similarly broad software compromise: that campaign was financially motivated and disclosed within weeks, whereas the Zimbra chain sat exploitable for eight months after a patch existed, with no coordinated attribution until this advisory.

Consensus view: CISA and NCSC assess the AA26-204A advisory's 15-agency signature list as itself a deterrent signal: a joint attribution this broad pairs GCHQ-sourced signals intelligence with CISA's federal enforcement lever to name a state-supported actor publicly rather than merely documenting a technical indicator.

Counter-view: China's CNCERT has argued in prior joint-advisory cycles that Western coalitions conflate confirmed exploitation capability with confirmed mass data breach, treating a demonstrated exploit chain as proof of successful large-scale exfiltration before forensic scoping across every named victim is complete.

Key tension: Whether the 90-day mail-exfiltration window CISA cites reflects confirmed theft at every victim organisation or the outer bound of what LAUNDRY BEAR's access made possible.

Sources:CISA

Mentions:NSA →FBI →ANSSI →AIVD →Clop →China →FSB Centre 16 →France →Russia →GCHQ →SolarWinds →CVE-2026-42897 →MOVEit →Zimbra Collaboration Suite →CISA →NCSC →LAUNDRY BEAR →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CISA· 24 Jul 2026

Read original →

Causes and effects

Caused by

NCSC names FSB Centre 16 over routers

The FSB Centre 16 router-hijacking advisory two weeks earlier already showed coalition attributions scaling past the usual two-to-four signatories, a pattern the 15-agency LAUNDRY BEAR advisory extends.

Occurred 9 Jul 2026

Read story →

This Event

Zimbra preview leaks mail to Russia

A preview-triggered exploit removes the user-error step defensive training relies on, leaving patch speed on the webmail appliance as the only working control.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.