Russian Hackers Read 90 Days of Email With No Click

There is no attachment to avoid. No link to hover over. A message lands in the inbox of a defense contractor, a ministry or a newsroom running Zimbra Collaboration Suite, the recipient opens it, and by the time the page finishes rendering the attacker has the last three months of that person's email.

Sixteen agencies across the US, UK, Netherlands, Canada, Australia, New Zealand and ten European partners described that campaign in joint advisory AA26-204A. The exploit is nicknamed beehive, or Ulej, the Russian word for it. The advisory's assessment is blunt: the activity "almost certainly indicates this group's involvement in espionage activities with Russian government backing."

Key Takeaways

• CVE-2025-66376 is a stored cross site scripting flaw in Zimbra Collaboration Suite's Classic web client that executes attacker JavaScript the moment a crafted email is rendered, with no click required, according to the UK NCSC.
• Zimbra patched the flaw on November 6, 2025 in ZCS 10.0.18 and 10.1.13, but LAUNDRY BEAR had been exploiting it as a zero day since at least July 2025.
• The Ulej payload harvests 90 days of mail, browser saved passwords, session tokens, the organizational address book and 2FA backup codes pulled through Zimbra's own APIs.
• Ulej creates an app specific credential named ZimbraWeb, giving attackers IMAP, POP3 and SMTP access that survives a password reset.
• Targets span defense, government, energy, education, law enforcement, media, NGOs and technology across NATO members, Ukraine and Africa, with the technique tested on Ukrainian victims first.

What Is CVE-2025-66376?

CVE-2025-66376 is a stored cross site scripting vulnerability in the Classic user interface of Zimbra Collaboration Suite, caused by the HTML sanitizer mishandling CSS @import directives inside email bodies. The bug is not that the sanitizer misses a payload. It is that the sanitizer builds one.

Attackers split an svg onload tag into fragments padded with decoy @import sequences and HTML comments. Zimbra's filter reads the mess, decides none of it is executable markup, and dutifully strips the @import pieces out. The characters left behind snap together into <svg onload=eval(atob(...))>, which the browser runs, as The Hacker News documented.

This is the second render time code execution flaw in Zimbra's Classic web client to surface this month. Google's Threat Analysis Group found a separate stored XSS bug that Zimbra fixed out of cycle on July 9, 2026 in ZCS 10.1.19. Two teams finding the same class of bug in the same component weeks apart suggests the sanitizer, not any single flaw, is the problem.

How Does a Zero Click Email Exploit Work?

A zero click email exploit runs on the act of displaying the message, so the victim's only mistake is opening their inbox. Webmail is a web application, the email body is untrusted HTML, and the client renders it inside a session already authenticated as the user. Any script that escapes the sanitizer inherits everything that user can do.

LAUNDRY BEAR sent these messages from accounts it had already compromised, so sender reputation checks had nothing to flag. Help Net Security reported that the group's backend infrastructure, tracked as Flowerbed, shows signs AI assisted in writing the codebase.

What Does Ulej Steal, and Why Does 2FA Not Help?

Ulej takes the mailbox and the means to get back into it: 90 days of messages packaged as TGZ archives and exfiltrated over DNS queries, plus CSRF and session tokens, browser saved passwords, the full organizational email directory and the target's Zimbra version.

Two factor authentication does not help, for a simple reason: nothing in this chain is a login. The script is already inside an authenticated session, so it never meets a prompt. It then pulls the account's 2FA scratch codes through Zimbra's own APIs and provisions an app specific password named ZimbraWeb, granting IMAP, POP3 and SMTP access outside the browser entirely. Resetting the password does not revoke that credential. Neither does patching the server.

Who Did LAUNDRY BEAR Target?

The victim list is a map of what Moscow wants to read: defense industrial base, federal and local government, energy, education, law enforcement, media, NGOs and technology, across NATO members, Ukraine, Commonwealth of Independent States countries and Africa. The NCSC says the technique was tested on Ukrainian targets before being turned on the West.

Media and NGOs sitting on that list is the part reporters should read twice. Ninety days of mail is not a snapshot, it is a working quarter: sources cultivated, documents received, colleagues looped in. It arrives with the organizational address book, turning one compromised newsroom account into a targeting list for every other one. Same escalation path as the fake Google alerts Chinese contractors sent journalists and diaspora activists, and the reason Proton's discovery of 116,000 journalist records on dark web markets matters.

Why Did It Take a Year to Warn Anyone?

Roughly twelve months separate first exploitation from public attribution, and most of that gap came after the fix existed. Exploitation began by July 2025. The patch shipped November 6, 2025. CISA added CVE-2025-66376 to its Known Exploited Vulnerabilities catalog on March 18, 2026, and the advisory naming LAUNDRY BEAR landed July 23, 2026.

To a defender the zero day window is the least interesting part. Four months of zero day exposure is bad luck. The eight and a half months between a shipped patch and the advisory explaining why it mattered is a choice, and every unpatched server in that stretch was being read by an intelligence service nobody had named yet.

Why Email Users Should Care

Most people reading this do not run Zimbra. What travels is the assumption underneath it, which every mail client shares: that an email is a document, and displaying a document is safe.

Email tracking pixels are the everyday end of that same design. A marketer's invisible 1x1 image fires on render for the same reason Ulej does: the client fetches whatever the sender embedded before you have decided whether you trust them. One reports your open time and rough location, the other takes the mailbox, but the mechanism is identical. That is why disabling automatic remote content loading is a security control, not a privacy nicety.

Gmail and Outlook users are not exposed to CVE-2025-66376. But self hosted webmail carries a large share of government, university and NGO mail, so the person reading your tip or handling your case file may well be on a client like this one.

What Should You Do Now?

If your organization runs Zimbra, patching is step one and it is not sufficient on its own. Work through the rest:

• Upgrade Zimbra Collaboration Suite to 10.0.18, 10.1.13 or later, then check the Zimbra Security Center for anything newer.
• Audit and revoke app specific passwords on every account. Any passcode named ZimbraWeb is, per the advisory, almost certainly attacker created. Check for unexplained IMAP or POP3 enablement at the same time.
• Regenerate 2FA seeds and backup scratch codes for every account on an affected server, and force a full session invalidation. Rotating passwords alone leaves the stolen recovery codes valid.
• Review mailbox forwarding rules and OAuth grants for anything you did not create, the two quietest ways a mailbox keeps leaking after remediation.
• Disable automatic remote content loading and treat message rendering as an attack surface. NIST publishes baseline guidance for organizations without a security team.

The uncomfortable part is not that Russia found a Zimbra bug. It is that a mailbox stays readable after you have done everything the headline told you to do, because the credential the attacker left behind was never the one you rotated.

Sources: CISA advisory AA26-204A, the UK NCSC, The Record, The Hacker News, and Help Net Security.