Laundry Bear
Russia
Tracked by CyberSIXT since 14 Jan
- Articlesall time
- 13
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 2
- Research reportsall time
- 3
13 articles from 10 outlets; the latest 5 days ago.
- Article
- Official notice
- Research report
Show as table
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
Microsoft tracks Laundry Bear as Void Blizzard, while Malpedia lists TA488 and UAC-0190 as aliases2,3. CISA describes Laundry Bear as Russian state-supported and dates its phishing activities to mid-2025; Infosecurity describes its motivation as espionage1,4.
Ars Technica reported that Laundry Bear exploited CVE-2026-42897 in Exchange Server to deploy OWAReaper within Outlook Web Access, extracting credentials5,3. CISA reported that Laundry Bear exploited CVE-2025-66376 in Zimbra Collaboration Suite against Western government and commercial organizations, stealing emails and global address lists when users viewed malicious messages1. The NCSC said Laundry Bear targeted defense and education sectors in the United States6.
Sources
- LAUNDRY BEAR Uses CVE-2025-66376 to Hack Zimbra via Phishing · CISA · 2026-07-23
- Laundry Bear: alias · Microsoft
- Laundry Bear: alias · Malpedia
- TA488 employs half‑click OWA exploit against government targets · Infosecurity · 2026-07-29
- Russian hackers use Exchange XSS bug to plant OWAReaper · Ars Technica · 2026-07-30
- UK NCSC alerts on Laundry Bear zero click attack on Zimbra email · NCSC (UK) · 2026-07-23
Diamond Model
What the record links to Laundry BearRecorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).
Names and sources
- Void Blizzard
- CyberSIXT coverage, Malpedia, Microsoft, MISP Galaxy
- LAUNDRY BEAR
- Malpedia, Microsoft, MISP Galaxy
- TA488
- Malpedia, MISP Galaxy
- UAC-0190
- Malpedia, MISP Galaxy
Attributed facts
- Origin
Russia Microsoft · Void Blizzard, MISP Galaxy
- Category
State Microsoft · Void Blizzard
CVEs exploited
2 CVEs an article attributes to Laundry BearVendors targeted
Malware and tools
MITRE ATT&CK® techniques
No MITRE ATT&CK® techniques are recorded for Laundry Bear.
- Ransomware attackers exploit severe flaws within three days, Rapid7 warnsSecurityWeek
- Russian hackers use Exchange XSS bug to plant OWAReaperArs Technica
- TA488 employs half‑click OWA exploit against government targetsInfosecurity
- TA488 leverages CVE-2026-42897 to plant OWAReaper in OutlookSecurityOnline
- Zimbra XSS bug CVE‑2025-66376 lets Russian hackers steal mailSOCRadar
- Police shut down Kratos phishing group behind credential theftSecurityWeek
- US agencies warn Laundry Bear exploits CVE-2025-66376 in ZimbraSecurity Affairs
- Russian hackers exploit Zimbra zero‑day to spy on agenciesDark Reading
- TA488 and TA458 Steal Government Email Using Half-Click Webmail ExploitsSecurityOnline
- LAUNDRY BEAR Uses CVE-2025-66376 to Hack Zimbra via PhishingCISA · official notice
- UK NCSC alerts on Laundry Bear zero click attack on Zimbra emailNCSC · official notice
- Russian zero-click attack exploits Zimbra flaw CVE-2025-66376Infosecurity
The latest 12 are listed. See all 16 articles in the timeline.