Russian hackers use ‘zero-click’ email attacks against organizations

Russian state-backed hackers are employing "zero-click" phishing campaigns that target a vulnerability in the Zimbra Collaboration Suite (ZCS) software, according to Proofpoint. These attacks, the subject of a recent advisory from the UK's National Cyber Security Centre (NCSC), allow adversaries to steal email correspondence from organizations operating in critical sectors without requiring user interaction beyond opening a malicious email, based on information published by IT Pro.

The "beehive" attacks, attributed to the Russian group Laundry Bear (also known as TA488 and Void Blizzard), exploit a flaw in Zimbra webmail, allowing attackers to compromise systems simply by viewing a crafted email. This method bypasses traditional user training against clicking links, as the exploit triggers automatically. Initially targeting a vulnerability tracked as CVE-2025-66376, the group later adapted its techniques to exploit a second vulnerability in Outlook Web Access. The campaign has targeted Ukrainian government entities, U.S. defense, nuclear, and research sectors, exfiltrating email data, session tokens, and credentials.

The attackers have demonstrated a pattern of quickly moving to new exploit chains, targeting sectors such as government, telecoms, finance, and aerospace. The evolution of these attacks, moving from highly targeted mobile exploits to mass espionage via email, poses a significant threat to organizations holding sensitive information.

Source: IT Pro