The Department of Defense Cyber Crime Center (DC3),
in coordination with the National Security Agency (NSA), Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and international partners, has released a joint Cybersecurity Advisory detailing an active campaign attributed to Russian state-sponsored cyber actors.

The Threat

The advisory highlights malicious cyber activity associated with the threat group tracked as LAUNDRY BEAR.

The actors are exploiting CVE-2025-66376, a vulnerability affecting certain versions of
the Zimbra Collaboration Suite Classic Web Client. The vulnerability can be triggered
when a user views a specially crafted malicious email, without requiring the user to
click a link or open an attachment.

Successful exploitation may allow threat actors to compromise authenticated user
sessions and gain unauthorized access to sensitive email information.

Take Action Now

Network defenders, information technology administrators, and organizations using the Zimbra Collaboration Suite should:

• Review the joint advisory.
• Identify potentially affected Zimbra systems.
• Apply the latest vendor-supported security updates immediately.
• Review the advisory’s indicators of compromise for signs of malicious activity.
• Implement the recommended mitigations and investigate suspected compromises.

The full advisory includes indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), technical findings, and mitigation guidance to help organizations
detect and defend against this activity.

Read the Full Advisory (PDF)