International alert spotlights Russia-linked attacks on Zimbra webmail

Russian state-aligned APT 'Laundry Bear' conducted a zero-click phishing campaign exploiting a Zimbra webmail vulnerability (CVE-2025-66376) to immediately execute malicious JavaScript from compromised emails and exfiltrate sensitive data (recent emails, passwords, contact lists, 2FA tokens) from government, defense, transportation and financial targets across Ukraine, NATO countries and others; agencies and vendors urge immediate patching or use of alternative mail clients.