Breaches and incidentsBriefChecked against a primary source
Joint advisory AA26-204A: LAUNDRY BEAR zero-click Zimbra campaign
CISA, NSA, FBI and partners: Russian APT LAUNDRY BEAR exploited CVE-2025-66376 in Zimbra Collaboration Suite so that viewing an email in vulnerable webmail...
- Disclosed
What happened
- CISA, NSA, FBI and partners: Russian APT LAUNDRY BEAR exploited CVE-2025-66376 in Zimbra Collaboration Suite so that viewing an email in vulnerable webmail was enough; 10+ organizations compromised since Jul 2025 (DIB, federal and local government, law enforcement, tech, education, media, NGOs). Custom tool “Ulej” aggregates and exfiltrates mail, passwords and 2FA tokens.
- Attribution: the authoring agencies.
Live scores
Live scores
CVE-2025-66376- EPSS
- 0.202
likely to be attacked soon - VEDAS
- 0.557
some exploit evidence - On CISA KEV
- Yes, since 2026-03-18
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
- https://www.cisa.gov/news-events/news/cisa-nsa-fbi-and-partners-warn-zimbra-collaboration-suite-users-ongoing-russian-state-supported
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.