Laundry Bear (Void Blizzard) Zimbra Zero-Click Espionage — Joint International Advisory

CVE-2025-66376 is a stored cross-site scripting vulnerability in the Classic UI of Zimbra Collaboration Suite that allows a malicious JavaScript payload to execute as soon as a user views an email. The Russian state-sponsored group tracked as Laundry Bear, Void Blizzard, and CL-STA-1114 has exploited this zero-click flaw continuously since July 2025, five months before Zimbra patched it in November 2025 with releases 10.1.13 and 10.0.18. Once triggered, the payload exfiltrates the victim's last 90 days of email, account passwords, 2FA tokens, search history, organization Global Address List, and any newly created application passcodes through actor-controlled Flowerbed infrastructure that uses both DNS and HTTPS channels.

This is not a routine phishing story. The view-based mechanism eliminates the weakest link in most campaigns: user action. The advisory notes Ukrainian targets were hit first as a testbench before broader NATO, CIS, and African deployment, which indicates operational discipline rather than opportunism. The sectors listed include government, defense, education, energy, law enforcement, media, finance, transportation, and technology, covering virtually every vertical with public-facing Zimbra instances, and because the exploit captures the full 90-day archive plus directory metadata, a single successful view can yield organizational mapping sufficient for follow-on espionage without additional access. The joint advisory from CISA, FBI, NSA, and 13 international partners confirms sustained state backing, which distinguishes this from criminal ransomware campaigns that lack the same persistence incentives.

Patch to ZCS 10.1.13 or 10.0.18 immediately; if patching is impossible, disable the Classic webmail client and redirect users to alternative clients. Hunt for persistence in /opt/zimbra/log/mailbox.log for high volumes of SOAP requests including SearchGalRequest batches, CreateAppSpecificPasswordRequest with the name "ZimbraWeb", GetScratchCodesRequest, and ModifyPrefsRequest enabling IMAP (zimbraPrefImapEnabled set to TRUE). Check endpoint browsers for localStorage items named zd_comp_YYYY-MM-DD, which the script uses to avoid re-collecting previously exfiltrated email. Monitor for frequent DNS A queries to subdomains matching the pattern d-{victim-id}.{type} against domains such as zmailanalytics.com, zimbra-metadata.com, analyticemailmeter.com, emailanalytics.com.ua, mailnalysis.com, zimbrastat.com, zimbrasoft.com.ua, synacorzimbra.nl, and istc-cloud.com. Inspect outbound HTTPS for POST requests with custom X-Filename headers such as telemetry_{1-20}.json or telemetryData_{0-89}.json, and for binary payloads with application/octet-stream content typed to paths /v/p and /v/d. Revoke all Application Passcodes and 2FA scratch codes for affected users, force password resets, and assume any password stored in an autocomplete-enabled manager was captured.

Watch for two developments. First, any change in the payload's XOR encryption key or SVG structure would break current network signatures and require updated detection rules, since the attackers rotate payloads specifically to bypass basic signatures. Second, confirmation of a new Zimbra vulnerability being exploited in the wild would signal that Laundry Bear has moved on from CVE-2025-66376, which is likely once patch adoption reaches critical mass; until then, unpatched ZCS instances remain at sustained risk.