Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

## Executive summary A joint advisory details a Russian state‑supported APT (LAUNDRY BEAR / Void Blizzard / TA488) that exploited a zero‑day XSS in Zimbra (CVE-2025-66376) to run a view‑based JavaScript payload (Ulej) which collected and exfiltrated up to 90 days of email, GAL entries, credentials, 2FA scratch codes and app‑specific passwords to actor‑controlled infrastructure (Flowerbed/Catcher) via DNS and HTTPS; the advisory includes IoCs, detection guidance, and mitigation and remediation recommendations including urgent patching, monitoring, and credential resets.