Laundry Bear Reportedly Uses Zimbra Zero-Day in Attacks on U.S. and Ukrainian Targets

A state-sponsored group identified as “Laundry Bear” is reportedly exploiting a previously unknown vulnerability in Zimbra email software in campaigns targeting organizations in the United States and Ukraine.

The activity centers on what researchers describe as “half-click” phishing. Unlike conventional phishing attacks, which typically require a recipient to select a link, open an attachment or submit credentials, this technique reportedly needs only limited interaction: opening or previewing the malicious email may be enough to trigger the attack.

The approach highlights the security risks associated with email preview features. Users may believe they have taken no meaningful action when they simply view a message, while vulnerable software can process embedded content automatically. In environments that rely heavily on webmail, this type of exploitation could reduce the protection offered by user awareness training and conventional phishing defenses.

The reported use of a Zimbra zero-day is significant because vulnerabilities that have not yet been publicly disclosed or patched can give attackers an advantage before defenders have effective remediation guidance. Organizations using Zimbra should monitor vendor security advisories, apply available updates promptly and review email-related indicators for suspicious activity.

Defensive considerations

• Keep Zimbra and associated components updated with the latest security fixes.
• Review logs for unusual message-processing activity, unexpected account behavior and access from unfamiliar locations.
• Limit unnecessary exposure of webmail services and apply additional access controls where practical.
• Use endpoint and network monitoring to identify exploitation attempts that may not require a traditional click.

The available report provides few technical details about the vulnerability, the affected versions or the full scope of the campaign. As a result, organizations should treat the activity as a potential threat and rely on confirmed guidance from Zimbra and relevant security authorities for specific detection and mitigation steps.