Five Eyes Issues Joint Warning: Russian State-Backed 'Laundry Bear' Exploits Zimbra Zero-Day (CVE-2025-66376) for Silent Mailbox Exfiltration
Executive Summary
A joint cybersecurity advisory released by CISA, NSA, FBI, the UK National Cyber Security Centre (NCSC), and Five Eyes intelligence partners alerts organizations to an active cyber espionage campaign conducted by Russian state-sponsored threat actor 'Laundry Bear'. The group has weaponized a zero-day vulnerability in Zimbra Collaboration Suite (CVE-2025-66376) to conduct covert, zero-click email surveillance against Western government, defense, energy, media, and technology entities, as highlighted in reports by Cybersecurity Dive and Infosecurity Magazine.
Incident Metric
Details
Vulnerability ID
CVE-2025-66376
Threat Actor
Laundry Bear (GRU-aligned)
Attack Vector
Zero-click CSS @import Injection
Affected Software
Zimbra Collaboration Suite
Deep-Dive Technical Analysis
Root Cause & Vulnerability Mechanism
CVE-2025-66376 stems from insufficient input sanitization of CSS @import directives within Zimbra Collaboration Suite's HTML email parser. When an infected email is delivered, the webmail client automatically processes inline CSS stylesheets upon rendering or previewing the message.
Zero-Click Payload Execution
The malformed CSS payload tricks the browser into executing arbitrary JavaScript within the context of the user's active webmail session. Crucially, this execution occurs without requiring any link clicks, attachment downloads, or user interaction, making it a highly effective "zero-click" exploit.
Automated Data Exfiltration
Upon execution, the payload silently connects back to attacker-controlled command-and-control (C2) servers. According to Infosecurity Magazine, the malicious script is capable of exfiltrating:
* Up to 90 days of inbox messages.
* Contact lists from the Global Address List (GAL).
* Active session authentication cookies.
These capabilities provide the attackers with long-term persistence and the ability to impersonate legitimate users within the target environment.
Global Espionage Campaign Details
Threat Actor Attribution
The activity is tracked as 'Laundry Bear', a group associated with GRU-aligned state-backed cyber units. This actor specializes in high-value strategic intelligence gathering, often focusing on political and military objectives.
Targeted Sectors
Strategic targeting focuses heavily on NATO member states. Per Cybersecurity Dive, the following sectors across the US, UK, Canada, Australia, and New Zealand have been prioritized:
* Government ministries and diplomatic entities.
* Military contractors and defense industries.
* Critical energy suppliers and telecommunications providers.
* Investigative journalism outlets.
Tactical Evolution
The shift toward zero-click webmail vulnerabilities underscores a broader trend where intelligence agencies bypass multi-factor authentication (MFA). By hijacking established session tokens directly inside web browser contexts, Laundry Bear can maintain access even in environments secured by modern authentication protocols.
Industry Impact and Actionable Mitigations
To defend against CVE-2025-66376 and the tactics employed by Laundry Bear, the Five Eyes partners recommend the following immediate actions:
1. Immediate Patching: Apply official Zimbra Collaboration Suite updates and security hotfixes immediately to eliminate the CSS parsing defect.
2. Enforce Content Security Policy (CSP): Restrict inline script execution and external CSS stylesheet loads by enforcing strict CSP headers across Zimbra webmail web servers.
3. Audit Mailbox Rules & Egress: Conduct forensic audits of user-defined mailbox forwarding rules, administrative accounts, and out-of-band network egress logs for unauthorized API connections.
4. Session Management & Isolation: Shorten webmail session timeouts, invalidate active session tokens upon suspicious IP changes, and segment webmail infrastructure behind Zero Trust Network Access (ZTNA) gateways.