Overview
Alina Zimmer • 08.09.2026 | Threat Detection

LAUNDRY BEAR – How a Russian hacker group steals emails without anyone clicking

Laundry Bear

On August 7, 2026, Fox News published an article with the sensational headline “Russian hackers can steal emails without a click”. Sounds like clickbait, but technically speaking, it hardly is. That is going to be the core of the following article.
LAUNDRY BEAR, a Russian, state-sponsored hacker group whose latest campaign no longer even requires a click on the wrong link. All they need is for you to open an email.

What is a “LAUNDRY BEAR”?

LAUNDRY BEAR is the name given to this group by the Dutch domestic and foreign intelligence service AIVD and the military intelligence service MIVD. In the security industry, other designations for presumably the same group are also in circulation. According to current knowledge, the group has been active since at least April 2024, but it was not publicly named until May 2025.

The authorities suspect a clear motive behind the group: espionage.
There is no evidence of financial extortion, but there is evidence of highly targeted, systematic harvesting of email communications. Classic intelligence work in digital form, presumably with backing from the Russian government.

The targets are by no means limited to government agencies. Organizations from the following sectors are particularly frequently affected:

  • Defense industry
  • Education
  • Energy
  • Law enforcement
  • Media
  • NGOs
  • Technology

Another striking pattern is one that the authorities explicitly highlight: Before targeting Western NATO states, the group apparently prefers to test its methods on Ukrainian targets first; Ukraine essentially serves as a testing ground for new attack techniques.

From Phishing Click to Zero-Click Exploit

The early days of LAUNDRY BEAR were technically rather unspectacular. Early campaigns, documented since May 2025, relied on classic password spraying, phishing pages, and stolen credentials from underground sources.
One example: a fake login page that looked like the registration portal for a European defense and security summit. Anyone who entered their Microsoft credentials there handed them over directly to the attackers via a modified version of the open-source tool Evilginx, including session cookies that could even be used to bypass two-factor authentication.

From July 2025 onward, the picture changed fundamentally. LAUNDRY BEAR began using self-developed malware called “Улей” / “Ulej”, Russian for “beehive”, specifically against companies that use the Zimbra Collaboration Suite as a webmail solution. For this, Ulej exploited CVE-2025-66376, which at the time was a zero-day vulnerability. It was not officially published in the National Vulnerability Database until January 2026, and it was patched in ZCS versions 10.1.13 and 10.0.18.

Technically, it is a stored Cross-Site Scripting vulnerability, Stored XSS, CWE-79, in Zimbra’s Classic Web Client. The webmail client does not properly sanitize certain CSS @import directives in incoming emails. Proofpoint, the security provider, reconstructed how sophisticated the implementation was in detail under the campaign name “TA488”:

The actual malicious element, an <svg onload=…> tag that executes JavaScript, is not sent as a whole, but split into individual fragments and hidden inside an invisible display:none div. In between, the attacker deliberately inserts useless @import directives and HTML comments. Zimbra’s filter does not recognize the individual fragments as executable code and removes only the inserted @import sequences – what remains is exactly the executable <svg onload=eval(atob(…))> tag, which the browser then executes normally. Proofpoint calls this obfuscation technique “Tag-Splitting”. The inner payload is additionally Base64-encoded and XOR-encrypted.

Official assessments also differ on how much user interaction is actually required. The NVD assigns a CVSS score of 6.1 and assumes user interaction is required, while MITRE rates the same vulnerability at 7.2 and says it is not. Unit 42 of Palo Alto Networks simply describes the attack as “Zero-Click”.
In practice, it amounts to the same thing for the victim: the email is opened, the code runs, but from their perspective, nothing more happens.

What Happens in the Background

Once the code introduced by Ulej is active, it carries out twelve automated steps, according to CISA findings, and collects:

  • the victim’s emails from the last 90 days – everything except the Trash/Junk folder
  • the victim’s email address
  • passwords stored in the password manager and automatically filled in öm
  • the organization’s complete global address list
  • two-factor scratch codes
  • a newly created Application Passcode. A kind of second password that Zimbra provides for email clients without 2FA support, such as IMAP

For permanent access and persistence, the script silently enables IMAP access for the account in the background via a SOAP request and creates its own Application Passcode named “ZimbraWeb”. This keeps the access active even if the victim later changes their password. A circumstance that many affected parties will probably notice too late.

When stealing the global address list, the malware proceeds stubbornly and systematically. It brute-forces all possible two-character combinations from a character set consisting of letters, numbers, and a few special characters, divided across 20 request batches. Not very elegant, but apparently effective.

Ulej, ZimReaper, CL-STA-1114: Many Researchers and Many Names

Virtually every security provider that has independently analyzed the campaign assigns its own names to the actor and malware. CISA calls the malware “Ulej”, Proofpoint refers to the exact same JavaScript payload as “ZimReaper” and tracks the actor under the designation TA488. Unit 42, in turn, refers to CL-STA-1114. Whether all of these names actually refer to the same group has not been conclusively established, although the authorities themselves explicitly point out in their warning that the mapping of the various tracking names to one another does not necessarily correspond one-to-one.
At least one thing is clear: A comparison of the published indicator lists shows that Unit 42 (CL-STA-1114) and Proofpoint (TA488) name the same nine command-and-control domains, meaning the two names at least describe the same intrusion set.

Unit 42 also provides concrete infrastructure figures, at least nine C2 IP addresses and nine domains, with each server active for an average of only 35.4 days before the group moves on. Unit 42 identifies government agencies, defense, transport, and finance in NATO states, Ukraine, the CIS countries, and Africa as affected sectors and regions. For the US, Proofpoint specifically adds government, academic, and defense organizations, including facilities associated with nuclear installations.

The attribution question becomes even more complicated due to a case from January 2026.
The security provider Seqrite documented an attack on a Ukrainian hydrology authority under the name “Operation GhostMail”, in which exactly the same vulnerability was exploited, but attributed the activity with only medium confidence to the previously known group APT28. The Dutch domestic and foreign intelligence service AIVD, which coined the name LAUNDRY BEAR, on the other hand, explicitly treats LAUNDRY BEAR and APT28 as two separate actors. For defenders, this naming dispute ultimately changes little.

Where Does the Data Disappear To?

The stolen information ends up on dedicated server infrastructure rented specifically for this purpose, which the attackers themselves call “Flowerbed”. A containerized Python project with four Docker components. A receiving service (“Catcher”), certificate management via Let’s Encrypt, an Nginx reverse proxy for encrypting data traffic, and a simple health check (“Gardener”). The servers are usually used for only 7 to 60 days before the group moves to new infrastructure, typically to make detection more difficult.

An interesting side note: the source code of Flowerbed shows signs of having been developed with the assistance of AI. Together with the reuse of open-source tools such as Evilginx, this suggests a group with limited in-house development capabilities rather than a highly specialized elite team.

The data exfiltration itself takes place over two channels in parallel, inconspicuous DNS requests for smaller amounts of data, Base32-encoded, and encrypted HTTPS connections for the bulk of the data, including the compressed email archives.

What Should Affected Organizations Do?

The authorities’ recommendations are unambiguous:

  1. Patch Immediately Anyone who has not yet installed ZCS 10.1.13 or 10.0.18 should do so with the highest priority.
  2. Where Patching Is Not Possible in the Short Term: switch to alternative mail clients and avoid the classic Zimbra web client.
  3. Use Passkeys Instead of Password Autofill to prevent the automatic harvesting of credentials through password-manager interception.
  4. Monitor Network Traffic: for example, unusually high volumes of outgoing data to VPS providers, suspicious DNS requests with randomly generated-looking subdomains, or connections through known VPN services such as Mullvad, which the group prefers to use.
  5. If Compromise Is Suspected: revoke all Application Passcodes and 2FA scratch codes, change passwords across the organization, and specifically search for Application Passcodes named “ZimbraWeb”; a legitimate occurrence of this is excluded.

Important: A mere update only closes the entry point, it does not bring back anything that has already gone through the door. Or anything that has established itself in the form of access credentials.

According to Proofpoint and Seqrite, anyone who wants to know whether they have already been affected should specifically check:

  • in the /opt/zimbra/log/audit.log file, look for calls to CreateAppSpecificPassword and remove credentials with the name “ZimbraWeb”,
  • identify accounts where zimbraPrefImapEnabled is set to TRUE without an apparent business reason,
  • monitor SOAP calls to GetScratchCodesRequest, which should practically never occur during normal operation,
  • check DNS traffic for the published C2 domains as well as unusually long, randomly generated-looking subdomain requests,
  • and scan emails that were delivered but never opened using the YARA rule (published by Proofpoint) for the fragmented @import pattern.

When patching, it is worth taking a second look at the version number: Zimbra 10.0 officially reached end of support on December 31, 2025, so version 10.0.18 is at best a temporary solution. If possible, users should switch directly to a current 10.1 build, the latest version, 10.1.20, as of July 20, 2026, also closes four additional previously unknown Stored XSS vulnerabilities in the Classic Web Client.

Conclusion

Fox News aptly summarized what CISA emphasized in its warning: LAUNDRY BEAR has evolved from clumsy credential phishing into a group capable of operationalizing a genuine zero-day exploit, despite its overall technical capabilities being considered rather average. They therefore demonstrate that you do not have to be an elite hacker team to cause maximum damage with the right vulnerability.
For organizations using Zimbra, this primarily means one thing: patching is the only effective line of defense against an attack in which the victim literally has to do nothing wrong.

Sources:

Share post on:

XING
Twitter
LinkedIn

Alina Zimmer • Autor

Cyber Defense Analyst

Driven by her particular interest in digital forensics and cybersecurity, Alina Zimmer decided to pursue a part-time degree program in cybersecurity. Through this program, she deepened her knowledge of current cyber threats, attack methods, and how to defend against them. Today, she brings her technical expertise and enthusiasm for IT security to the SECUINFRA team.

> all articles
Cookie Consent with Real Cookie Banner