Russian-Linked Groups Exploit Zimbra Zero-Click Email Vulnerability

Russian state-backed actors tracked as Laundry Bear, TA488, and Void Blizzard have conducted zero-click phishing campaigns exploiting CVE-2025-66376 in Zimbra Collaboration Suite webmail deployments. Crafted emails can trigger malicious code execution merely when viewed on vulnerable systems, enabling theft of email correspondence, session tokens, and credentials without requiring a victim to open a link or attachment. Reported targets include Ukrainian government bodies and U.S. defense, nuclear, and research organizations, alongside government, telecommunications, finance, and aerospace entities.

Azerbaijan’s National Cybersecurity Agency warned that Zimbra users have faced these campaigns since July 2025 and that compromised systems could expose sensitive mail data, allow unauthorized account access, and support follow-on intrusions. Organizations should apply Zimbra security updates, monitor for anomalous logins and account changes, revoke active sessions and investigate suspected compromise, preserve backups, and reinforce phishing and social-engineering awareness.