Actor Profile

Laundry Bear (also tracked as Void Blizzard by Microsoft) is a Russian state-sponsored APT group first publicly attributed by Dutch intelligence agencies in May 2025 following their 2024 compromise of the Dutch National Police. The group conducts cyberespionage operations focused on intelligence collection against organizations aligned with Russian strategic interests, primarily targeting NATO member states and Ukraine. Since at least 2024, Laundry Bear has successfully compromised organizations in the defense, transportation, and aviation sectors supporting Ukraine, as well as entities across the Defense Industrial Base, federal and local government, education, energy, law enforcement, media, NGOs, and technology sectors.

TTPs (Tactics, Techniques, Procedures)

Laundry Bear combines initial access via phishing with exploitation of CVE-2025-66376, a cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite's Classic UI. The zero-click exploit executes JavaScript automatically when victims view specially crafted HTML emails, harvesting the last 90 days of emails, credentials, passwords, Global Address Lists, and 2FA tokens without user interaction. The group creates unauthorized Zimbra application passcodes to maintain persistent access while bypassing MFA. Data exfiltration occurs via the "Flowerbed" collection framework using dual channels: DNS A-record queries for smaller encoded data and HTTPS uploads of compressed archives for larger payloads. The group also deploys adversary-in-the-middle (AiTM) phishing kits that impersonate legitimate Zimbra login portals to steal credentials and session cookies. Relevant MITRE ATT&CK techniques include T1566 (Phishing), T1189 (Drive-by Compromise), T1059.007 (JavaScript), T1114 (Email Collection), T1567 (Exfiltration Over Web Service), T1048.003 (Exfiltration Over Unencrypted Non-C2 Protocol - DNS), T1556 (Modify Authentication Process), and T1539 (Steal Web Session Cookie).

Targets & Patterns

Laundry Bear targets organizations aligned with Russian strategic interests across NATO member states and Ukraine. Victim sectors include the Defense Industrial Base, federal and local government agencies, education, energy, law enforcement, media, non-governmental organizations, and technology. The group has successfully compromised organizations supporting Ukraine, specifically entities in defense, transportation, and aviation sectors. The targeting pattern reflects intelligence collection priorities consistent with Russian state interests, focusing on government, military, and critical infrastructure entities that possess strategic information or support Ukraine's defense efforts. The group's exploitation of widely-deployed Zimbra email infrastructure enables broad access to sensitive communications across multiple sectors simultaneously.

Historical Context

Laundry Bear was first publicly attributed by Dutch intelligence agencies in May 2025 following investigation of a 2024 compromise of the Dutch National Police that exposed personnel information. The group has been active since at least 2024, with Microsoft tracking the same activity cluster as Void Blizzard. The current Zimbra exploitation campaign represents continued evolution of the group's email-focused intelligence collection operations. Earlier in 2025, BleepingComputer documented a separate Laundry Bear campaign targeting Ukraine's military using charity-themed phishing emails to deliver malware disguised as donation requests. The group exploited CVE-2025-66376 as a zero-day before Zimbra patched it in November 2025 and continues to target unpatched servers. CISA subsequently tagged the vulnerability as actively exploited, indicating sustained operational tempo against vulnerable infrastructure.

Defensive Recommendations

  • Immediately update Zimbra Collaboration Suite to the latest version to patch CVE-2025-66376 and review all available security updates
  • Hunt for connections to known Laundry Bear infrastructure including domains mailnalysis.com, emailanalytics.com.ua, zimbrastat.com, zimbra-metadata.com, istc-cloud.com, and zmailanalytics.com
  • Monitor DNS queries for anomalous A-record lookups with encoded data patterns and investigate HTTPS uploads of compressed archives to external servers (T1048.003, T1567)
  • Audit and revoke unauthorized Zimbra application passcodes, particularly those containing 'ZimbraWeb', and review mailbox access logs for suspicious authentication activity (T1556)
  • Implement phishing-resistant multi-factor authentication and monitor for AiTM phishing attempts impersonating Zimbra login portals (T1539, T1566)

---

# Geopolitical Context

Geopolitical Context

The campaign reflects Russia's sustained intelligence collection priorities against Western institutions and Ukraine-aligned entities. Laundry Bear (Void Blizzard) appears to operate within Russia's broader cyber espionage apparatus, focusing on targets consistent with strategic intelligence requirements: NATO member states, defense industrial base organizations, and entities supporting Ukraine's defense. The group's exploitation of CVE-2025-66376 as a zero-day before November 2025, combined with adversary-in-the-middle phishing infrastructure, demonstrates sophisticated operational tradecraft. The targeting of diverse sectors—including defense, government, law enforcement, media, and NGOs—suggests intelligence collection aligned with Russia's geopolitical interests in monitoring Western policy formation, defense capabilities, and support networks for Ukraine. The Dutch attribution in May 2025, following the 2024 compromise of Dutch National Police systems, underscores the group's focus on NATO member state security and intelligence infrastructure.

State Actor Alignment

Laundry Bear is attributed by Dutch intelligence agencies and CISA to Russian state sponsorship. The group's targeting patterns—focused on NATO members, Ukraine, and organizations supporting Ukrainian defense—align with Russian strategic intelligence priorities. Microsoft's tracking of the same activity cluster as Void Blizzard corroborates the attribution. The 2024 compromise of Dutch National Police, publicly attributed by Dutch intelligence in May 2025, represents a significant breach of a NATO member's law enforcement infrastructure. The group's operational focus on defense industrial base entities, government agencies, and Ukraine support networks is consistent with tasking from Russian intelligence services seeking to monitor Western military aid, policy deliberations, and Ukrainian defense capabilities.

Business Impacty pro region

The campaign has direct implications for European security, particularly NATO member states and Ukraine. The compromise of Dutch National Police in 2024 exposed personnel information and demonstrated Russia's willingness to target law enforcement infrastructure within the Alliance. Organizations in the defense industrial base across NATO countries face ongoing risk, as Laundry Bear seeks intelligence on weapons production, supply chains, and technology transfers to Ukraine. The targeting of entities supporting Ukraine—including defense, transportation, and aviation sectors—threatens operational security of military aid flows and logistical networks. Media and NGO targeting suggests efforts to monitor information operations and civil society support for Ukraine. The use of charity-themed phishing against Ukrainian military personnel indicates direct operational targeting of frontline forces. European organizations using Zimbra Collaboration Suite, particularly in government and defense sectors, remain at elevated risk if running unpatched versions vulnerable to CVE-2025-66376.

Forecast

If organizations fail to patch CVE-2025-66376 and implement phishing-resistant authentication, Laundry Bear is likely to continue exploiting Zimbra infrastructure for intelligence collection. Given the group's documented success against NATO member states and Ukraine-aligned entities since 2024, further compromises of government, defense, and law enforcement targets appear probable. If geopolitical tensions between Russia and NATO persist or escalate—particularly regarding Ukraine support—the group's targeting of defense industrial base and logistics networks may intensify. Organizations that apply patches, revoke unauthorized application passcodes, and deploy robust multi-factor authentication may reduce their exposure, though the group's demonstrated use of adversary-in-the-middle phishing kits suggests credential theft will remain a viable attack vector. Monitoring for connections to identified infrastructure and suspicious authentication activity will be critical for early detection of compromise attempts in the near term.