When the Zimbra zero-click exploit first surfaced, the most counterintuitive thing was that victims didn’t have to click anything at all. That’s how Laundry Bear, a Russian state‑sponsored hacking group also known as Void Blizzard, managed to steal the last 90 days of email from dozens of organizations without a single user interaction. We’ve seen the same pattern before, but the speed and scope of this campaign make it a stark reminder that even well‑known software can become a silent threat.
Key Takeaways
- Laundry Bear combined phishing with a zero‑click XSS bug (CVE‑2025‑66376) to steal email data.
- The vulnerability was patched in November 2025, yet many servers remain exposed.
- Attackers exfiltrate data via DNS A‑record queries and HTTPS uploads to a “Flowerbed” framework.
- They generate legacy application passcodes to bypass MFA and retain long‑term access.
- CISA recommends updating Zimbra, revoking unauthorized passcodes, and hardening MFA.
Zimbra zero-click exploit used by Laundry Bear
The flaw lives in Zimbra Collaboration Suite’s Classic UI, where a crafted HTML email can run JavaScript the moment the message is opened. That’s a classic cross‑site scripting (XSS) vector, but the zero‑click nature means the victim never sees a malicious link. CISA says the group exploited the bug as a zero‑day before Zimbra released its patch, and they’re still hunting down unpatched installations. We’ve observed similar tactics in other supply‑chain attacks, yet the simplicity here is unnerving.
How the attack chain works
First, the adversary sends a phishing email that looks like a legitimate Zimbra login page. Because the email contains the XSS payload, opening it triggers the script automatically. That script then gathers the victim’s mailbox address, password, Global Address List (GAL), and even two‑factor authentication (2FA) tokens. It also creates a new Zimbra application passcode, which legacy clients like IMAP or ActiveSync can use without the TOTP flow. That’s how the attackers stay in the account even after the user changes their password.
Technical Architecture of the Zero‑Click Exploit
At the core of the exploit is a payload that embeds a <script> tag inside the HTML body of an email. When the mail client renders the message in the Classic UI, the browser engine evaluates the tag immediately. No user action is required because the rendering process itself is the trigger. The script runs with the same privileges as the logged‑in user, allowing it to read cookies, session identifiers, and any DOM elements that expose credential fields.
Once the script has harvested the needed data, it reaches out to external infrastructure. Small pieces of information—such as usernames or token strings—are converted into a series of DNS queries. Each query encodes a few bytes of data in the subdomain portion of the request, a technique that uses the ubiquitous nature of DNS traffic. Because many firewalls treat DNS as benign, the queries often slip by unnoticed.
For larger artifacts like compressed mailbox archives, the script switches to HTTPS. It opens a POST request to a server that hosts the “Flowerbed” collection framework. The framework accepts the upload, stores the file, and provides a confirmation response. Using HTTPS masks the payload from deep‑packet inspection tools, and the encrypted channel also helps the attackers avoid triggering content‑filter alerts.
The final piece of the architecture is the generation of a new application passcode. The script invokes an internal API that creates a token tied to the victim’s account. Because the token bypasses the usual time‑based one‑time password flow, any client that supports static credentials can authenticate indefinitely. This backdoor survives password resets and MFA enrollment changes, giving the attackers persistent access.
From DNS tunnels to HTTPS drops: The exfiltration methods
CISA’s advisory notes that the stolen data travels over two channels. Small chunks—like usernames or token strings—are encoded in DNS A‑record queries, a technique that can slip past many firewalls. Larger payloads, such as compressed mailbox archives, are uploaded over HTTPS to servers running the group’s “Flowerbed” collection framework. That’s a double‑edged approach that lets the attackers adapt to whatever network controls the victim has in place.
Indicators of compromise
The advisory lists a handful of domains used to host fake Zimbra portals. They’re things like mailnalysis.com, emailanalytics.com.ua, and zmailanalytics.com. If you see outbound connections to those hosts, that’s a red flag. CISA also released IP addresses tied to the campaign, and they advise scanning logs for any DNS queries that resolve to those domains. That’s a practical way to catch the attack early.
Who’s being targeted and why it matters
According to CISA, the campaign spans the Defense Industrial Base (DIB), federal and local governments, education, energy, law enforcement, media, NGOs, and technology firms. That’s a broad brush, but the common thread is that many of these entities share a reliance on Zimbra for internal communications. The group has a history of focusing on NATO members and Ukraine, and Microsoft has documented successful compromises of Ukrainian defense and transportation sectors. It’s ironic that a tool meant to simplify collaboration ends up being the weakest link.
Historical context of Laundry Bear
The Dutch intelligence agencies first linked the group to a 2024 breach of the Dutch National Police. That incident exposed personal data of police personnel and led to the public attribution of the group under the name Void Blizzard. Since then, Laundry Bear has pivoted to intelligence collection, targeting entities aligned with Russian strategic interests. That’s why the current Zimbra campaign feels like a natural evolution of their playbook.
What organizations can do right now
First and foremost, update every Zimbra server to the latest version. The patch released in November 2025 closes the XSS hole, and staying current is the simplest defense. Next, review the IOCs published by CISA and scan for connections to the listed domains and IPs. If you find any unauthorized application passcodes—especially those labeled “ZimbraWeb”—revoke them immediately. That’s a quick win that cuts off the attackers’ backdoor.
- Deploy phishing‑resistant MFA wherever possible.
- Monitor authentication logs for unusual passcode usage.
- Run threat‑intel feeds that include the listed domains.
- Consider network‑level DNS filtering for the malicious hosts.
What This Means For You
For developers maintaining email‑related services, the Zimbra incident underscores the danger of client‑side script execution in trusted UI components. You can’t rely on user awareness alone; you need to enforce content‑security policies that block inline JavaScript, even in internal tools. That’s a lesson that applies far beyond Zimbra.
For founders and security leaders, the campaign is a reminder that legacy authentication mechanisms—like application passcodes—can become a backdoor when MFA is bypassed. If your product still supports basic auth or static tokens, you should phase them out and move to modern, phishing‑resistant flows. That’s the only way to keep a determined adversary from slipping through the cracks.
Looking ahead, the question isn’t whether more zero‑click exploits will surface, but how quickly defenders can adapt their detection and response strategies. Will organizations treat legacy email platforms as a low‑priority risk, or will they finally give them the scrutiny they deserve?
Competitive Landscape and Similar Threat Vectors
Zero‑click attacks have appeared in other high‑profile incidents, often targeting messaging or collaboration platforms. Those campaigns share a reliance on script injection, DNS tunneling, and covert HTTPS uploads. The pattern shows that attackers favor tools that are widely deployed and rarely scrutinized by endpoint users. By reusing a familiar technique, groups can reap the benefits of existing infrastructure while minimizing development overhead.
In parallel, supply‑chain compromises have demonstrated how a single vulnerable component can affect dozens of downstream customers. The Zimbra case fits that narrative: a flaw in a core UI module cascades into credential theft across multiple sectors. When the same exploit chain is paired with phishing lures, the impact multiplies. This convergence of tactics signals a broader trend where attackers blend social engineering with technical shortcuts.
Organizations that have already hardened their email stacks often employ layered defenses—such as sandboxed rendering, strict CSP headers, and outbound DNS monitoring. Those measures can disrupt the early stages of the chain, forcing the adversary to resort to noisier methods. While no single control is a silver bullet, a defense‑in‑depth approach raises the cost of execution and can buy time for incident response.
Key Questions Remaining
How many unpatched Zimbra installations remain active after the November 2025 release? What proportion of those servers still accept legacy application passcodes? Are there undisclosed variants of the XSS payload that evade current detection signatures? Answers to these queries will shape remediation priorities for both public and private sectors.
Will threat‑intel platforms expand their coverage of DNS‑based exfiltration patterns linked to the “Flowerbed” framework? If so, analysts could surface additional malicious domains that were not listed in the original advisory. That would provide a broader net for early detection and reduce the window of exposure.
What role will regulatory bodies play in enforcing timely patch adoption for collaboration tools? Past incidents have prompted guidance, but enforcement mechanisms vary. Clarifying expectations could drive faster remediation and limit the attack surface for future campaigns.
Sources: BleepingComputer, CISA
