The UK National Cyber Security Centre, CISA, NSA, and twelve allied agencies published joint advisory AA26-204A on July 23, formally attributing an active email collection campaign to LAUNDRY BEAR — a Russian state-supported threat actor. The campaign exploits a Zimbra Collaboration Suite vulnerability to silently harvest up to 90 days of email from targeted accounts. No link needs to be clicked. No attachment needs to be opened. The attack fires when the victim’s browser renders a crafted email in the Zimbra webmail interface.
This advisory warrants direct CISO attention for two reasons: the zero-click exploitation model breaks the assumptions most email security programmes are built on, and the targeting scope is broad enough that most organisations of strategic interest should consider themselves at risk if they’re running Zimbra.
What LAUNDRY BEAR Is Actually Doing
The vulnerability, CVE-2025-66376, is a stored cross-site scripting flaw in Zimbra’s handling of CSS @import directives in email content. When a malicious email reaches a Zimbra server, the payload is stored. When the target user opens or previews that email in the webmail interface, the injected script executes within their authenticated session.
LAUNDRY BEAR’s tool, called Ulej in the advisory, uses that authenticated session to:
- Extract up to 90 days of historical email content from the compromised mailbox
- Harvest entries from the Global Address List (personnel data, org chart context)
- Capture session authentication tokens for potential replay
The 90-day extraction window is the intelligence value. This isn’t about stealing individual emails. It’s about harvesting 90 days of strategic correspondence: internal discussions about third-party relationships, personnel matters, contract negotiations, operational plans. That data set has significant value for intelligence-driven follow-on operations — targeted social engineering, insider threat development, or compromising third parties mentioned in collected email.
Why Your Email Security Controls Don’t Cover This
Most enterprise email security architectures are built to stop phishing: detect malicious links and attachments, train users not to click suspicious content, and quarantine suspicious messages before they reach inboxes. LAUNDRY BEAR’s campaign bypasses this model entirely.
The malicious email may contain nothing a gateway scanner recognises as malicious. The payload is CSS, which is legitimate email content. There is no link to user-report as suspicious. Anti-phishing training is not relevant because the user takes no action that distinguishes this email from any other. The attack succeeds the moment the email is previewed in webmail.
The implication: your phishing simulation click rate, your security awareness training completion rate, your email gateway threat detection metrics — none of these tell you whether your organisation was successfully targeted in this campaign. The relevant controls are Zimbra patch status, network-level monitoring of anomalous Zimbra API activity, and post-compromise detection of bulk data access.
Assessing Your Exposure
If you run Zimbra Collaboration Suite: Apply the patch for CVE-2025-66376 immediately. This should not wait for a scheduled maintenance window. An unpatched Zimbra deployment is actively exploited against organisations across defence, government, energy, media, education, and NGO sectors. The advisory’s targeting scope is specifically broad — LAUNDRY BEAR appears to be running a systematic collection programme against any Zimbra deployment of potential intelligence value.
Following the patch:
- Invalidate all active sessions and force re-authentication across your Zimbra estate
- Pull 90 days of Zimbra SOAP API access logs and look for patterns consistent with Ulej’s bulk retrieval behaviour: large numbers of sequential mailbox queries in short timeframes, access outside normal hours, unfamiliar source IPs
- If you find anomalous access patterns, treat email content from the past 90 days as potentially compromised and assess secondary risk exposure — third-party relationships named in correspondence, personnel data, strategically sensitive content
If you don’t run Zimbra: Your immediate exposure to this campaign is lower. The risk worth carrying to your board is the technique class, not just this specific implementation. Zero-click email exploitation — where server-side vulnerabilities in email rendering allow attacks without user interaction — is a meaningful threat category. Webmail platforms with complex HTML/CSS rendering have historically been a source of similar vulnerabilities. This advisory is the moment to assess whether your webmail platform is actively patched and whether you have detection coverage for anomalous bulk email access from authenticated sessions.
Board Reporting Frame
If you need to brief your board on this advisory, the relevant framing is:
A joint advisory from UK and US intelligence agencies has identified a Russian state-sponsored threat actor actively collecting email from organisations in our sectors. The attack requires no user action and bypasses standard phishing defences. Our exposure depends on whether we’re running the affected software and whether it’s patched. Email content from the past 90 days may have been accessible to the attacker if we were targeted while running an unpatched version.
The governance question for the board is whether the residual risk from a 90-day email collection window — given the strategic communications that pass through email — is within tolerance, and whether current controls for detecting silent bulk data collection from authenticated sessions are adequate.
Recommended Actions by Priority
- Patch Zimbra now — CVE-2025-66376 is addressed in current releases. This is a priority-zero patch given active exploitation.
- Invalidate all Zimbra sessions — force re-authentication estate-wide following the patch.
- Conduct a 90-day API access log review — identify Ulej-pattern bulk retrieval activity. CISA advisory AA26-204A contains specific indicators of compromise.
- Assess secondary exposure — if anomalous access is found, identify what sensitive content may have been collected and who might have been named in that correspondence.
- Enable MFA on Zimbra — the advisory explicitly recommends this as a residual risk reduction measure.
- Restrict external Zimbra webmail access — limit to VPN or known IP ranges where operationally feasible.
- Review webmail security posture broadly — regardless of whether you run Zimbra, assess what detection coverage exists for anomalous bulk email access from authenticated sessions across your webmail estate.
The patch is urgent and not controversial. The harder question is the retrospective: what did a sophisticated state actor potentially read over the past 90 days, and what does that mean for follow-on risk?