Russian hackers exploit Zimbra zero-click to steal emails

A Russian state-backed hacking group has exploited a critical vulnerability in widely used email software to steal sensitive data from Western government agencies and other organizations without requiring victims to click a link or open an attachment, according to a major international cybersecurity advisory issued on July 23, 2026. The campaign, attributed to the group known as Laundry Bear, has successfully targeted more than 10 organizations since July 2025.

The joint advisory, issued by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency, FBI, and counterparts from the United Kingdom, Canada, Australia, New Zealand, and more than a dozen European nations, warns that the hackers exploited a now-patched vulnerability in the Zimbra Collaboration Suite. The technique, described as a "zero-click" or "half-click" exploit, allows the attackers to compromise a system when a user simply opens or previews a malicious email in an unpatched version of the Zimbra webmail client.

Targets have spanned multiple sectors, including the defense industrial base, federal and local governments, law enforcement, technology companies, educational institutions,...