CISA, the NSA, the FBI, and cybersecurity agencies from more than a dozen allied nations, including the Netherlands, the UK, Australia, and Canada, issued a joint advisory this week exposing an active campaign by LAUNDRY BEAR, a Russian state-supported threat group also tracked as Void Blizzard. Since July 2025, the group has been breaking into email accounts on Zimbra Collaboration Suite servers without needing the victim to click a link, enter a password, or visit a fake login page. The victim only has to preview the message.
How the Zero-Click Exploit Works
The entry point is CVE-2025-66376, a cross-site scripting flaw in the Classic UI of Zimbra Collaboration Suite. Malicious JavaScript embedded in a specially crafted HTML email executes the moment the message renders in a vulnerable webmail session, with no click, download, or credential entry required from the target. That JavaScript runs inside the victim’s own authenticated Zimbra session, which means it inherits whatever access that session already has.
LAUNDRY BEAR pairs the exploit with a custom tool the advisory calls Ulej, Russian for beehive. Once triggered, Ulej automatically collects and exfiltrates the victim’s last 90 days of email, their email address, their password, entries from the organization’s Global Address List, and any two-factor authentication tokens active in the session. It does not stop at theft. Ulej also generates a new Zimbra application passcode and sends it back to the attacker. Application passcodes exist to let legacy clients that use IMAP or ActiveSync connect without going through a TOTP prompt every time, and a passcode minted this way gives LAUNDRY BEAR standing access to the mailbox that survives a password reset and never has to pass an MFA challenge again.
Who Is Being Targeted
The joint advisory ties LAUNDRY BEAR’s Zimbra campaign to victims in the Defense Industrial Base, federal and local government, education, energy, law enforcement, media, non-governmental organizations, and technology, spread across the United States, Ukraine, and other NATO-aligned countries. Zimbra shipped a fix for CVE-2025-66376 on November 6, 2025, in versions 10.1.13 and 10.0.18. The campaign has continued for months past that date, which tells you plainly where the actual risk sits: not in the absence of a patch, but in the gap between when a patch ships and when a self-hosted mail server actually gets it installed.
Why DMARC Has Nothing to Say About This
It is worth being precise about why this campaign sits entirely outside what DMARC checks. DMARC, SPF, and DKIM exist to answer one question: did this message come from infrastructure the claimed sending domain authorized to send it? They say nothing about what the message contains once it arrives. CVE-2025-66376 fires because of how the Zimbra Classic UI renders HTML inside an email body, not because of anything related to who the sender claims to be. An attacker could route this exact payload through a domain with a flawless DMARC record at full enforcement, and the exploit would trigger identically, because the vulnerability lives in the webmail client’s parsing logic, not in domain authorization.
The application-passcode step makes the gap even harder to close after the fact. Once LAUNDRY BEAR holds a valid passcode for a compromised mailbox, any mail sent through that account using it authenticates completely normally. It originates from the real mail server, it can be signed with the domain’s genuine DKIM key, and it will pass DMARC alignment at any recipient checking it, because as far as the protocol can tell, the account owner is the one sending it. DMARC was built to catch someone forging a domain from outside the organization. It has no way to notice that a legitimate mailbox has quietly been handed a second owner.
What Defenders Should Do
Patch to Zimbra Collaboration Suite 10.1.13 or 10.0.18 immediately if you have not already. The fix has existed since November 2025, and this campaign is direct evidence of what an unpatched window that long actually costs.
Audit existing application passcodes on every mailbox, not just going forward. A passcode the account owner does not remember generating is a strong indicator of prior compromise, and rotating or revoking it does not undo whatever was already exfiltrated during the window it was active.
Treat any unpatched Zimbra instance as potentially already compromised, not just exposed. Given the campaign has run since July 2025, checking logs for unusual GAL exports, unexpected application passcode creation events, or mail access from unfamiliar IP ranges matters more right now than confirming the patch level alone.
Keep DMARC enforcement and webmail patching as two separate, non-substitutable controls. Locking every domain you own to a reject policy remains correct and necessary. It will not close a client-side rendering flaw, because the two controls defend against entirely different failure modes.
The Takeaway
LAUNDRY BEAR’s Zimbra campaign is not a DMARC bypass in any meaningful sense, because it never had to go near DMARC to succeed. It targets the software that renders your mail, not the identity claims your authentication records vouch for, and once it plants a working application passcode, it inherits the same authenticated sending path DMARC exists to protect. A patch that has been available since November would have stopped this cold. No DMARC policy, however strict, was ever going to.
Excello Mail gives you continuous visibility into your DMARC aggregate reports and the sources actually sending on your domain’s behalf, so unusual authenticated activity from a compromised mailbox stands a better chance of getting noticed while your team keeps the rest of the mail stack patched. Sign up for free to Excello Mail and put that visibility in place today.