Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries

A joint advisory warns that the Russian state‑sponsored group Laundry Bear (Void Blizzard) exploited a zero‑day in Zimbra Collaboration Suite (CVE-2025-66376) in an active espionage campaign from July 2025, stealing up to 90 days of email, passwords, search history, directory data and 2FA tokens; the vulnerability was not patched until November 2025 and affected governments and organizations across multiple critical sectors, with IOCs and mitigations released by multiple countries.