Russian State-Supported Zimbra Phishing: SafeBreach Coverage for CISA Advisory AA26-204A

On July 23, 2026, the National Security Agency (NSA), together with the Federal Bureau of Investigation (FBI), the Netherlands Defence Intelligence and Security Service (MIVD), the Netherlands General Intelligence and Security Service (AIVD), the Cybersecurity and Infrastructure Security Agency (CISA), and more than 20 additional US and allied partner agencies, issued joint Cybersecurity Advisory (CSA) AA26-204A: Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite. This advisory provides critical intelligence on an ongoing Russian state-supported phishing campaign, including the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) observed as the actors steal email and sensitive data from targeted organizations.

Since July 2025, the threat group tracked as LAUNDRY BEAR has used phishing emails to target the Zimbra Collaboration Suite (ZCS) across US and allied government and commercial networks—leveraging a view-based exploit that triggers automatically when a recipient simply opens a malicious message in an unpatched webmail instance.

Understanding the Threat

LAUNDRY BEAR is a Russian state-supported advanced persistent threat (APT) group first publicly detailed in May 2025, when the Netherlands’ AIVD and MIVD and Microsoft independently highlighted the actor—Microsoft tracking it as Void Blizzard. Across the security industry the group is also tracked as CL-STA-1114 and TA488 (formerly UNK_PitStop).

Unlike financially motivated ransomware crews, LAUNDRY BEAR’s objective is espionage: bulk collection of email and organizational data from government and commercial targets aligned with Russian state intelligence interests. The campaign has been active since July 2025 and continues today against organizations that have not patched their Zimbra webmail.

What makes this campaign notable is its low interaction requirement. Using a custom capability the actors call “Ulej,” LAUNDRY BEAR sends phishing emails carrying a view-based exploit for CVE-2025-66376—a vulnerability in the ZCS webmail interface that executes automatically the moment a victim opens the email. No link needs to be clicked and no attachment needs to be opened. Once triggered, the exploit exfiltrates the organization’s email directory, the previous 90 days of the victim’s communications, and other sensitive information to servers controlled by the actors. The flaw was a zero-day when the campaign began and remains effective against any ZCS instance that has not applied the vendor’s fix.

Key Tactics, Techniques, and Procedures (TTPs)

The advisory maps LAUNDRY BEAR’s activity across the full ATT&CK chain (MITRE ATT&CK for Enterprise v19). The techniques below are grouped by tactic; Appendix A of the advisory provides the complete correlation, and Appendix B maps the corresponding MITRE D3FEND countermeasures.

Reconnaissance

• Active Scanning (T1595). Port-scans the internet to find and fingerprint exposed, exploitable ZCS infrastructure.
• Search Open Technical Databases: Scan Databases (T1596.005). Uses commercially available scan datasets to identify targetable ZCS servers.
• Search Open Websites/Domains (T1593). Leverages public information to support target development.
• Search Closed Sources (T1597) and Purchase Technical Data (T1597.002). Draws on previously exfiltrated data and purchased commercial datasets to refine targeting.
• Gather Victim Identity Information — Email Addresses (T1589.002) and Credentials (T1589.001). Compiles target user email addresses; the payload also attempts to lift the victim’s password from their password manager.

Resource Development

• Acquire Infrastructure (T1583) — Virtual Private Server (T1583.003). Procures VPSs from a range of providers (often with fabricated identities) and routes traffic through Mullvad VPN for OPSEC.
•  Develop Capabilities (T1587) — Malware (T1587.001) and Exploits (T1587.004). Built the custom “Ulej” payload and, at the time, a novel XSS exploit enabling arbitrary JavaScript execution.
• Obtain Capabilities — Tool (T1588.002) and Artificial Intelligence (T1588.007). Uses open-source tooling such as Evilginx2 and appears to have leveraged AI to assist development of its “Flowerbed” collection framework.
• Stage Capabilities (T1608). Deploys Flowerbed (Docker containers) to a procured cloud server to receive exfiltrated data.

Initial Access

• Phishing (T1566). Sends spear-phishing email carrying a malicious JavaScript payload—no link-click or attachment needed; simply viewing the message triggers it.
• Trusted Relationship (T1199). Since at least November 2025, sends payloads from previously compromised accounts that already have an established relationship with the target, frustrating anti-phishing controls.
• Valid Accounts (T1078). Uses credentials acquired from commercial datasets and prior compromises to access accounts.

Execution

• Exploitation for Client Execution (T1203). Exploits CVE-2025-66376 (CWE-79 cross-site scripting) so the JavaScript payload executes the moment the email is viewed in a vulnerable ZCS webmail client.

Persistence

• Account Manipulation (T1098). Enables IMAP and creates Application Passcodes to maintain access to the compromised mailbox.
• Modify Authentication Process: Multi-Factor Authentication (T1556.006). Generates Application Passcodes and steals 2FA “scratch codes” to bypass multi-factor authentication.

Privilege Escalation

• Valid Accounts (T1078). Reuses acquired account credentials to obtain privileged access.

Defense Evasion

• Obfuscated Files or Information (T1027.010, T1027.013, T1027.017). Command obfuscation plus a Base64-encoded, XOR-encrypted inner payload smuggled inside the “onload” attribute of an SVG element, letting the actors regenerate signatures easily.
• Use Alternate Authentication Material: Web Session Cookie (T1550.004). In prior AiTM campaigns, stole and replayed victim session cookies to authenticate.

Credential Access

• Adversary-in-the-Middle (T1557). Earlier campaigns used Evilginx2 to intercept credentials and session cookies.
• Modify Authentication Process: MFA (T1556.006). Application Passcodes and stolen scratch keys stand in for a valid 2FA token. 

Collection

• Email Collection (T1114) — Remote Email Collection (T1114.002). Harvests the victim’s last 90 days of non-junk email via API calls to the ZCS mail server.
• Automated Collection (T1119). The payload gathers information automatically in twelve asynchronous stages.
• Browser Session Hijacking (T1185). Rides the user’s authenticated browser session to issue SOAP/API requests as the victim.
• Archive Collected Data (T1560) and Data Staged: Remote Data Staging (T1074.002). GZIP-compresses harvested email and stages it on an actor-controlled VPS before onward transfer.

Discovery

• Account Discovery (T1087). Brute-forces the organization’s Global Address List (GAL) to enumerate additional users to target.

Exfiltration

• Exfiltration Over Alternative Protocol (T1048). Sends data out over both DNS and HTTPS to the Flowerbed infrastructure.
• Over Asymmetric Encrypted Non-C2 Protocol (T1048.002) and Over Unencrypted Non-C2 Protocol (T1048.003). Larger payloads (including email content) go over HTTPS; smaller ones are Base32-encoded and exfiltrated via DNS A-record queries.

Indicators of Compromise (IOCs)

The advisory publishes an extensive, historically attributed IOC set. The authoring agencies caution that LAUNDRY BEAR rotates infrastructure frequently—individual IPs, domains, and compromised sender addresses may already be stale—so verify current activity before acting on any single indicator. The indicators fall into several categories:

• Flowerbed VPS infrastructure: Nine actor-controlled domains and IPs active between July 2025 and March 2026 (for example, zmailanalytics[.]com, zimbra-metadata[.]com, and zimbrastat[.]com) used to receive exfiltrated data.
• TLS certificate hashes: SHA-1 hashes of the Let’s Encrypt X.509 certificates bound to the “*.i.*” wildcard subdomains the exfiltration traffic uses.
• Sender addresses: ProtonMail accounts used to procure infrastructure and distribute payloads, plus compromised accounts at Ukrainian domains (isofts.kiev[.]ua, navs.edu[.]ua).
• Malicious email samples: SHA-256 hashes of four email samples carrying the CVE-2025-66376 payload.
• Host-based artifacts:  In ZCS mailbox.log: bursts of SearchGalRequest SOAP commands, creation of an Application Passcode named “ZimbraWeb,” and GetScratchCodesRequest calls; on endpoints, browser localStorage entries named zd_comp_YYYY-MM-DD.

Useful hunting aids: exfiltration is triggered through image requests to d-{id}…i.{domain}/pixel.gif (DNS) and js-{id}.i.{domain}/v/p or /v/d (HTTPS), and the actors’ Nginx reverse proxy only forwards traffic whose TLS SNI matches “*.i.*.”

For the full, machine-readable set, download the AA26-204A STIX XML and STIX JSON bundles from the CISA advisory page.

SafeBreach Coverage & Playbook Attack Updates

In total, four simulations are mapped to AA26-204A: 110 and 903 (existing exfiltration-behavior coverage) and 11752 and 11753 (new IOC-based reachability coverage). Every method below runs from this same set.

Existing Behavioral Coverage

SafeBreach already simulates the exfiltration-over-alternative-protocol behavior (T1048) at the core of this campaign- data theft over both HTTPS and DNS, the two channels LAUNDRY BEAR uses to move stolen mailboxes and directories to its Flowerbed infrastructure:

• 110 – Covert data-asset exfiltration over HTTPS (POST)
• 903 – Covert data-asset exfiltration over DNS (TXT queries)

These simulations are mapped to MITRE ATT&CK and can be run immediately to validate that your DLP and egress controls detect and block the exfiltration techniques this campaign relies on.

New IOC-Based Coverage

To address the IOC guidance in AA26-204A, we are adding network-reachability simulations that validate whether your egress controls detect and block communication with the advisory’s exfiltration infrastructure.

• 11752 – Communication with APT (AA26-204A) using HTTP. Sends an outbound HTTP request to a SafeBreach-controlled server with an advisory-listed C2 domain set in the Host header, validating whether your controls detect and block egress to the campaign’s infrastructure.
• 11753 – ICMP Ping Request to APT (AA26-204A) C2 Servers. Sends an ICMP echo request to advisory-listed C2 IP addresses to validate whether your egress controls detect and block reachability to that infrastructure. This is an Advanced Action- it contacts real external infrastructure, so schedule it accordingly.

These simulations validate detection and blocking of communication with the campaign’s actor-controlled C2 indicators.

Together, these four simulations are the complete SafeBreach content mapped to AA26-204A: 110 and 903 validate the exfiltration behavior (HTTPS/DNS), and 11752 and 11753 validate reachability to the campaign’s C2 indicators. Run them from any of the methods below.

What You Should Do Now

SafeBreach customers can now validate their security controls against the campaign’s C2 and exfiltration indicators in multiple ways.

Method 1 — SafeBreach Scenarios: Navigate to the SafeBreach Scenarios page and choose CISA Alert  AA26-204A.

Method 2 — Attack Playbook: Open the Attack Playbook and filter by AA26-204A to view all associated attacks. You can also refer to the list above to confirm which AA26-204A attacks are available.

Method 3 — Known Attack Series Report: Select the AA26-204A report from the Known Attack Series report and click Run Simulations.

Additional Advisory Steps

Run the SafeBreach Simulations

1. Log into the SafeBreach platform and navigate to the updated playbooks mapped to AA26-204A.
2. Execute the AA26-204A simulations to test whether your controls detect and block outbound communication with the campaign’s actor-controlled C2 indicators.
3. Run all four mapped simulations: 11752 and 11753 for C2/IOC reachability, and 110 and 903 for the exfiltration-behavior coverage (all listed in the SafeBreach Coverage section above).
4. Review results to validate detection, surface gaps, and guide remediation.

Implement Mitigation Strategies

1. Patch the Zimbra Collaboration Suite to the latest version to remediate CVE-2025-66376; unpatched webmail remains exploitable.
2. Enforce multifactor authentication (MFA) for webmail and remote access to reduce the value of any stolen credentials.
3. Restrict and monitor outbound connections from mail infrastructure, and block traffic to the advisory’s listed exfiltration servers after vetting.
4. Review ZCS webmail configuration and limit automatic content rendering where feasible.
5. Investigate for the presence of the advisory’s IOCs and follow the CSA’s remediation steps if any are found.
6. Maintain and test offline backups of mail and directory data.

Employ Proactive Threat Monitoring

• Hunt for anomalous outbound transfers from ZCS servers, especially bulk mailbox or directory exports to unfamiliar external hosts.
• Alert on connections from mail infrastructure to the actor-controlled servers listed in the advisory.
• Review ZCS webmail logs for exploitation of CVE-2025-66376 and for activity associated with the “Ulej” capability.
• Flag mass access to the organizational email directory or to 90-day mailbox histories that is inconsistent with normal use.

Stay Ahead with SafeBreach

For a complete view of your security gaps against the LAUNDRY BEAR campaign, sign into SafeBreach and run the latest simulations mapped to AA26-204A. Because this campaign is built on stolen mailboxes, directories, and credentials—the raw material attackers use to move deeper into an environment—you can go a step further with SafeBreach Propagate.

Propagate enables you to assess how attackers could pivot across your environment post-compromise—mapping high-risk attack paths, visualizing lateral movement across network zones, and prioritizing remediation based on exposure to your most critical assets. Find out more in the SafeBreach Propagate solution brief.