CL-STA-1114

Void Blizzard, also tracked as LAUNDRY BEAR and CL-STA-1114, is a Russophone cyberespionage threat actor assessed to be aligned with Russian state interests. The actor has conducted espionage operations against government, defense, transportation, and financial organizations, with targeting spanning NATO member states, Ukraine, other CIS countries, and parts of Africa. Reported activity has been ongoing since at least 2024, with Zimbra-focused operations observed from July 2025. A prominent operation attributed with medium confidence to this actor is Operation GhostMail, which involved exploitation of CVE-2025-66376, a stored cross-site scripting vulnerability in Synacor Zimbra Collaboration Suite Classic UI. The actor used crafted phishing emails, including HTML content embedded in messages or attachments, to trigger JavaScript execution in vulnerable webmail sessions, in some cases characterized as zero-click exploitation. Observed payload behavior included theft of web session material, credentials, browser-saved passwords, two-factor authentication scratch codes, mailbox contents, search history, and directory data. The activity also established persistence by creating app-specific passwords that could survive password resets and enable continued mail access without normal two-factor prompts. Tradecraft associated with CL-STA-1114 includes spearphishing, exploitation of public-facing applications, JavaScript-based payload execution, obfuscation and decoding of malicious content, command-and-control-based exfiltration, credential theft, session hijacking, email collection, and persistence through abuse of legitimate mail platform features. The actor has also been linked to abuse of CVE-2025-66376 more broadly in campaigns targeting Western governments and organizations in Ukraine. The overall pattern is consistent with intelligence collection rather than financially motivated intrusion.