- NSA and international partners warned that the Russian-backed LAUNDRY BEAR group is targeting Zimbra users with phishing emails
- The campaign has targeted vulnerable and unpatched Zimbra systems since July 2025
- A custom tool called Ulej can exploit malicious emails to access sensitive data from targeted systems
The National Security Agency and international partners have issued a cybersecurity advisory warning that a Russian state-supported cyber group has been targeting Zimbra Collaboration Suite users with phishing emails since July 2025, the agency said Thursday.
As cyber threats continue to target sensitive intelligence and communications systems, the Potomac Officers Club’s 2026 Intel Summit on Sept. 24 will bring together intelligence leaders and industry experts to discuss cyber capabilities, secure information-sharing and technology modernization. Register now!
How Is LAUNDRY BEAR Targeting Zimbra Users?
The advisory, titled “Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite,” says that the LAUNDRY BEAR cyber group has targeted Zimbra deployments with a custom capability called Ulej. The tool supports a view-based exploit that automatically activates when a user opens a malicious email in a vulnerable version of the webmail service. The capability allows the actors to target unpatched Zimbra systems and attempt to exfiltrate email directories, the previous 90 days of email communications and other sensitive information.
What Does the Cybersecurity Advisory Provide?
The joint advisory details indicators of compromise observed during exfiltration and describes the associated network activity, providing organizations with information they can use to develop detection and mitigation measures. The joint advisory outlines specific remediation steps for organizations that find any of the listed indicators in their systems.
Which Agencies Co-Sealed the Advisory?
The advisory was issued by the NSA with multiple U.S. and international partners, including the FBI, Cybersecurity and Infrastructure Security Agency, Defense Counterintelligence and Security Agency, Department of War Cyber Crime Center, Department of the Treasury and Naval Criminal Investigative Service.
Cybersecurity and intelligence agencies from the Netherlands, Australia, Canada, the Czech Republic, Denmark, Estonia, Finland, France, Italy, Moldova, New Zealand, Poland, Spain, Sweden and the U.K. also co-sealed the advisory.
The advisory follows two recent NSA warnings about Russian cyber activity targeting network infrastructure. In April, the agency and its partners warned that GRU-linked actors, including APT28, Fancy Bear and Forest Blizzard, have been exploiting vulnerable routers to hijack DNS settings, redirect internet traffic and steal sensitive data. A July advisory warned that Russia’s Federal Security Service’s Center 16 was targeting routers and urged organizations to strengthen device security, including by updating firmware, disabling exposed services and replacing unsupported equipment.
