Share

UK government and intelligence agencies have issued an urgent warning about a sophisticated cyber-espionage campaign orchestrated by Russian state-supported threat actors.

The malicious campaign is driven by an advanced persistent threat group known as LAUNDRY BEAR, which is actively targeting organisations across Western government and commercial sectors to harvest sensitive email communications covertly.

The primary target of the operation is the Zimbra Collaboration Suite (ZCS), a widely used web-based email and enterprise productivity platform.

Unlike traditional phishing attacks that require a user to click a suspicious link or download an unsafe attachment, this operation utilises a stealthy zero-click exploit.  The hackers leverage a specific software vulnerability, tracked as CVE-2025-66376, alongside a custom data exfiltration tool called Ulej.

Under this method, a target only needs to view an incoming malicious email within a vulnerable webmail interface for the system to become compromised automatically.

Since mid-2025, investigators have identified more than ten successful or attempted breaches across critical industries including defence, local and federal government agencies, law enforcement, technology firms, educational institutions, media outlets, and non-governmental organisations.

Once inside the network, the threat group attempts to steal sensitive user credentials, including account passwords and multi-factor authentication tokens.

In response to the escalating threat, cybersecurity authorities are strongly urging organisations that use ZCS to apply the latest software patches immediately and continuously monitor webmail logs for suspicious activity. Officials emphasise that international cooperation remains vital for uncovering state-backed cyber threats and protecting essential networks from digital espionage.

NCSC