{"uuid": "cc13a232-50d4-4e91-b58d-2e78be6bb4c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-66376", "type": "exploited", "source": "https://t.me/pphm_HackerNews/2284", "content": "\ud83d\udd34 US Agencies Warn of Laundry Bear Campaign Targeting Unpatched Zimbra Servers\n\nUS agencies warn Russian group Laundry Bear is exploiting a patched Zimbra flaw to steal email accounts from organizations running unpatched servers.\n\nThe Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI) and other U.S. government and international partners published a joint advisory to warn that the Russia-linked APT group Laundry Bear (aka Void Blizzard) is targeting organizations using unpatched Zimbra Collaboration servers.\n\nThe attackers exploit CVE-2025-66376, an XSS flaw that allows malicious JavaScript embedded in HTML emails to run automatically when viewed, enabling account theft without user interaction. The vulnerability was exploited as a zero-day before being patched and remains under active exploitation against unpatched systems.", "creation_timestamp": "2026-08-23T00:00:45.216435Z"}