NCSC/NSA Advisory: Russia LAUNDRY BEAR Zero-Click Phishing on Zimbra Collaboration Suite

Vulnerability Overview Vulnerability Name: 'beehive' (or 'Uleq') Vulnerability Type: Zero-click phishing attack Vulnerability Description: The Russian state-sponsored threat actor LAUNDRY BEAR has utilized a new zero-click exploitation technique targeting Western organizations that use Zimbra Collaboration Suite (ZCS) software. This vulnerability allows attackers to steal email data without user interaction, simply by viewing a malicious email. Scope of Impact Affected Organizations: Western organizations using Zimbra Collaboration Suite (ZCS) software, including those in the defense, government, education, energy, legal, law enforcement, media, non-governmental organizations (NGOs), and technology sectors. Affected Regions: Western organizations globally, particularly NATO member states. Attack Timeline: Since July 2025, LAUNDRY BEAR has successfully targeted and exfiltrated sensitive email information. Remediation Immediate Actions: - Patch the vulnerability in ZCS software immediately. - Enhance network monitoring capabilities. Long-term Measures: - Register for the NCSC’s free Early Warning Service to receive notifications about malicious cyber activity. - Gain familiarity with zero-click techniques and implement corresponding mitigations. - Strengthen online account security in accordance with NCSC guidance. Additional Information Attacker: Russian state-sponsored hacker group LAUNDRY BEAR. Attack Objective: Espionage and theft of sensitive information. Technical Details: Artificial intelligence (AI) played a role in developing a simplified codebase, accelerating the speed, scale, and complexity of cyber threats. Relevant Links NCSC Joint Advisory Advisory on the NSA Website Download Advisory PDF: Russian State-Sponsored Hackers Targeting Zimbra Collaboration Suite Users Topics Phishing Additional Relevant Information Statements: - Security Minister Dan Jarvis MBE stated that the UK, in cooperation with allies, has exposed a Russian state-sponsored hacker group targeting Western organizations. - NCSC Chief Operating Officer Beth Hopkins CMG emphasized that hostile actors will continuously adapt their technology to exploit vulnerabilities and steal sensitive information. Related Resources Statement on Major IT Outage Check Your Email Security and Protect Your Customers QR Codes – What’s the Real Risk? Footer About NCSC: Privacy Notice, Cookies, Accessibility, Terms and Conditions, Social Media Policy Contact NCSC: Report an Incident, Report a Suspicious Message or Website, Verify NCSC Contact, Report a Vulnerability, Contact the Press Office Useful Links: GCHQ, MI5, SIS, NPSA, GOV.UK --- Note: No specific Proof of Concept (POC) code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

NCSC/NSA Advisory: Russia LAUNDRY BEAR Zero-Click Phishing on Zimbra Collaboration Suite