Russian hackers exploit Zimbra zero-click flaw for email theft

Russian state-sponsored hackers, known as Laundry Bear, are exploiting a previously patched zero-click vulnerability in Zimbra Collaboration email servers to steal sensitive emails. The attackers combine phishing tactics with the vulnerability exploitation to gain unauthorized access to targeted organizations' email accounts. The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about these attacks, which are attributed to the Russian hacking group Void Blizzard¹. The vulnerability, now patched, was used to compromise email servers without requiring any user interaction, allowing the hackers to extract confidential information. This shift from traditional criminal activity to state-aligned hacking operations changes the threat landscape, requiring organizations to adapt their security strategies to counter geopolitical threats. The fact that CISA is involved indicates a heightened level of concern, so what matters most to security practitioners is that they must reassess their threat models to account for these sophisticated state-sponsored attacks.