Russian hackers exploit unpatched Zimbra servers to steal emails

Russian state-backed group Laundry Bear (aka Void Blizzard/TA488) has been exploiting a Zimbra webmail XSS vulnerability (CVE-2025-66376) since July 2025 to steal up to 90 days of email, credentials, directory data, two-factor tokens, and application passcodes across government, defense, energy, education, media, NGOs and tech sectors; stolen data is collected on a Docker-based backend called "Flowerbed," the actors use Mullvad VPN and rotate infrastructure, and agencies recommend patching Zimbra, reviewing IOCs, and revoking unauthorized passcodes.