Laundry Bear Uses Zero-Click Zimbra Email Trap

How the attack worked

Laundry Bear, a threat actor linked with confidence to the Russian state, has been targeting Western organisations since at least 2024. Its most notable technique, called beehive or Ulej, is a zero-click phishing method aimed at Zimbra Collaboration Suite (ZCS) webmail. Rather than relying on a victim clicking a malicious link, the technique exploits CVE-2025-66376, a stored cross-site-scripting vulnerability in the ZCS classic user interface. By abusing CSS @import directives embedded in HTML email content, an attacker can trigger compromise the moment a target simply views the email in a vulnerable webmail client.

Earlier activity attributed to the same group involved a different approach: a malicious website masquerading as a European Defence and Security Summit registration portal, used to lure targets in defence and government circles into submitting information through a fake registration flow.

Why it succeeded

The core reason this technique is effective is that it bypasses the standard advice given in most security awareness training. Employees are typically taught to avoid clicking suspicious links or opening unexpected attachments, but a zero-click exploit does not require any of that. Merely viewing an email in a vulnerable version of ZCS webmail is sufficient to trigger compromise, which sidesteps the usual human decision point that awareness training is designed to influence.

The technique also targeted a broad range of sectors, including government, defence, education, energy, law enforcement, media, and NGOs, giving it a wide potential impact across organisations that rely on Zimbra webmail.

What to watch for

• Unexpected or unsolicited HTML-formatted emails, particularly ones with rich content that could load external resources
• Emails viewed through an unpatched classic Zimbra web interface
• Unexpected event invitations or registration requests tied to defence or government themes, especially where the site domain does not match the legitimate organiser
• Pressure to register quickly or provide unusually sensitive information through unfamiliar portals

How to build resistance

Organisations should prioritize rapid patching of internet-facing email systems, since Zimbra patched this specific flaw in November 2025 and the NCSC has urged any unpatched users to update immediately. Layered technical defences matter because patching alone will not stop every variant of this kind of attack.

Security teams should also assume the beehive technique could be adapted to exploit other email platforms and vulnerabilities beyond Zimbra, so monitoring and response planning should not be limited to a single vendor. Finally, awareness programs should be updated to reflect that some attacks require no click at all, reinforcing the need for technical controls alongside training rather than relying on user behavior as the sole defense.

What is the Laundry Bear zero-click attack?

It is a technique called beehive that exploits a stored cross-site-scripting flaw in Zimbra Collaboration Suite webmail, allowing compromise just from viewing a malicious HTML email.

Do victims need to click a link to be compromised?

No. Simply viewing the malicious email within a vulnerable version of ZCS webmail is enough to trigger compromise.

Has the Zimbra flaw been patched?

Yes, Zimbra patched the vulnerability, tracked as CVE-2025-66376, in November 2025, and the NCSC urges any unpatched users to update immediately.

Could this technique spread beyond Zimbra?

Yes, the underlying beehive technique could reportedly be adapted to exploit other vulnerabilities and email platforms.