Loading malware…
Ulej is a custom-developed email-compromise and data-exfiltration capability used by the Russian state-sponsored threat actor LAUNDRY BEAR, also tracked as Void Blizzard, CL-STA-1114, and TA488. It has been used since at least July 2025 in espionage operations targeting organizations running vulnerable Zimbra Collaboration Suite webmail, including entities in government, defense, education, energy, law enforcement, media, non-governmental, and technology sectors.
Ulej exploits CVE-2025-66376, a cross-site scripting flaw in Zimbra webmail, through a view-based, effectively zero-click mechanism. The malicious payload is embedded in a crafted email and executes when the victim merely views the message in a vulnerable webmail client. Reported implementations used obfuscated JavaScript concealed within an SVG element and protected with Base64 encoding and XOR encryption to hinder detection and signature-based blocking.
Once executed in the victim's authenticated browser session, Ulej uses Zimbra webmail functionality and SOAP requests to collect and exfiltrate sensitive mailbox and account data. Documented collection includes the victim’s recent email history, email address, password, Global Address List contents, two-factor authentication recovery material, application passcodes, device and environment details, and OAuth-related account information. The capability has also been observed attempting to coerce browser password managers into autofilling hidden fields to harvest stored credentials.
Ulej supports persistence by enabling IMAP access on compromised mailboxes and creating application-specific passwords that can allow continued mailbox access outside the browser session. Exfiltration has been observed over both HTTPS and DNS, with supporting attacker infrastructure referred to as Flowerbed and Catcher handling receipt and temporary storage of stolen data. The operation reflects a focused espionage objective centered on covert acquisition of organizational email and account data from Zimbra environments.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Supported by a custom-developed capability named “Ulej,” the actors leverage a view-based exploit that triggers automatically when a user views a malicious email within a vulnerable version of the webmail service.
Beginning around July 2025, LAUNDRY BEAR shifted toward a more technical method of email compromise... Using a custom-developed capability named “Улей” or “Ulej” (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from organizations who use the Zimbra Collaboration Suite (ZCS) product.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
T1589.001 — Gather Victim Identity Information: Credentials (Reconnaissance)
T1587.001 — Develop Capabilities: Malware (Resource Development)
T1587.004 — Develop Capabilities: Exploits (Resource Development)
T1078 — Valid Accounts (Initial Access)
Since at least November 2025, LAUNDRY BEAR began sending these phishing emails from victim infrastructure through compromised accounts [T1199].
Since July 2025, the Russian state-supported advanced persistent threat group known as LAUNDRY BEAR has utilized phishing emails to target the Zimbra Collaboration Suite (ZCS) across various U.S. and allied government and commercial networks.
The initial entry point for the attack is a spear-phishing email containing a JavaScript payload embedded within an SVG image.
Supported by a custom-developed capability named “Ulej,” the actors leverage a view-based exploit that triggers automatically when a user views a malicious email within a vulnerable version of the webmail service.
T1078 — Valid Accounts (Initial Access)
Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included ... Newly-created Application Passcode [T1098].
T1556.006 — Modify Authentication Process: Multi-Factor Authentication (Persistence)
T1078 — Valid Accounts (Initial Access)
Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included ... Newly-created Application Passcode [T1098].
payload JavaScript encodé en Base64, chiffré XOR
payload JavaScript encodé en Base64, chiffré XOR
dissimulé dans un attribut onload d’un élément SVG
T1078 — Valid Accounts (Initial Access)
T1556.006 — Modify Authentication Process: Multi-Factor Authentication (Persistence)
Additionally, the malicious payload attempts to manipulate password managers to auto-fill credentials into hidden login forms, allowing further credential theft.
T1556.006 — Modify Authentication Process: Multi-Factor Authentication (Persistence)
T1087 — Account Discovery (Discovery)
T1550.004 — Use Alternate Authentication Material: Web Session Cookie (Defense Evasion)
It exfiltrates emails and other sensitive user data from a victim’s system immediately after exploitation and stores the data in an actor-controlled unattributable virtual private server (VPS) [T1074.002] running LAUNDRY BEAR’s “Flowerbed” collection framework.
T1114 — Email Collection (Collection)
T1114.002 — Email Collection: Remote Email Collection (Collection)
Exfiltre en 12 étapes asynchrones
T1185 — Browser Session Hijacking (Collection)
For email exfiltration, the script sends it as a GZIP compressed archive [T1560].
For smaller data items, the malware encodes information in Base32 and triggers DNS lookups through specially crafted image URLs.
The exploit attempts to exfiltrate the organization’s email directory, the last 90 days of the victim’s communications, and other sensitive information to servers controlled by the actors.
L’exfiltration utilise deux canaux : DNS ... et HTTPS
HTTPS (JSON et octet-stream)
DNS (Base32, RFC 1035 compliant)
Larger files, including email archives and Global Address List (GAL) contents, are transferred over HTTPS to the Flowerbed infrastructure, secured by Let’s Encrypt certificates and processed via an Nginx reverse proxy.
53 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.