US Agencies Warn of Laundry Bear Campaign Targeting Unpatched Zimbra Servers

US and international security agencies warn that the Russia-linked APT 'Laundry Bear' exploited a Zimbra Collaboration zero-day (CVE-2025-66376) to execute JavaScript in viewed emails (zero-click), enabling credential theft, mailbox access persistence (IMAP enablement, application passwords), and exfiltration via attacker infrastructure (Flowerbed/Catcher). The advisory includes IOCs (malicious domains), technical details of the multi-stage payload and obfuscation, and remediation guidance including patching Zimbra, reviewing IOCs and authentication anomalies, and enforcing phishing-resistant MFA.