The Inbox as Listening Post: How a Russian Espionage Crew Turned Webmail Flaws into Access That Survives a Password Change- 351

August 25, 2026

Over the summer of 2026, three separate warnings showed how one of Russia’s newer espionage groups works its way into the mailboxes of Western institutions. Palo Alto Networks’ Unit 42 described a campaign that had been quietly draining Zimbra webmail accounts since July 2025, and Proofpoint showed the same group moving its technique to Microsoft’s Outlook Web Access. Then, in August, Poland’s national CERT warned that a separate, critical Zimbra flaw was already being exploited less than a month after its patch. 

The group is known as Laundry Bear, Void Blizzard or TA488 depending on the vendor. Its method needs almost nothing from the victim: an email that only has to be opened, sometimes not even that, and a browser that does the rest. Its latest tool does not settle for stealing a session. It rewrites the permissions of the mailbox itself, so a password reset or a reinstalled computer no longer removes the intruder. In a period when Western governments have taught their staff to distrust links and attachments, Russian intelligence has moved to a point where neither is needed. And it has targeted webmail, the platform still run on-premises by ministries, municipalities and mid-sized firms that cannot afford, or choose not to use, the cloud versions its exploits do not reach.

Unit 42 tracks the Zimbra activity as CL-STA-1114 and links it to the actor others call Void Blizzard and Laundry Bear. It places the group’s activity back to at least 2024, and the Zimbra campaign to July 2025. The lure is unremarkable by design: an email carrying news headlines, either as an HTML attachment or in the message body. Inside, an obfuscated section creates an invisible SVG image that, on loading, decodes a hidden script and runs it in the recipient’s browser. The flaw it exploits, CVE-2025-66376 in the Zimbra Collaboration Suite, means the payload can run without the recipient clicking anything. Unit 42 calls the technique zero-click, while Proofpoint calls it “half-click” because the message still has to be opened. Once running, the script sends the victim’s webmail data to a hard-coded command server: login credentials, email archives and even search histories. Proofpoint’s account of the same campaign, built around a tool it named ZimReaper, adds application passcodes and two-factor authentication codes to the haul. The operation has been notable for its stability rather than its novelty. Unit 42 saw minimal change in the payload over a year. It counted at least nine command-server IP addresses and nine domains, each active for an average of about thirty-five days. And it warned that the group continues to target unpatched Zimbra servers. The pattern is that of an intelligence service with a reliable collection tool and no reason to change it while it keeps working.

Proofpoint’s research showed the next step. Its target is Microsoft Exchange’s Outlook Web Access, on which a far larger share of governments and corporations depend. The group, which Proofpoint tracks as TA488, exploited CVE-2026-42897, a cross-site scripting flaw caused by OWA’s failure to clean the HTML in incoming messages. A crafted email runs its script as soon as it is opened in the browser. Microsoft disclosed the flaw on 14 May 2026 and confirmed active exploitation. But Proofpoint found campaign infrastructure set up as early as March, nearly two months earlier, which suggests the group used it as a zero-day. Targets included government bodies in the United States and Europe, as well as telecommunications, financial, hospitality and aerospace organisations. The lures were deliberately dull: supply chains, research updates, tourism, gas markets. Proofpoint linked the new backdoor, OWAReaper, to the group through its behavioural kinship with ZimReaper.

What sets OWAReaper apart is how it holds on. It runs entirely inside the OWA reading pane. It collects the victim’s address, username and Outlook configuration, and it plants invisible form fields so the browser’s autofill hands over the saved password. It then looks for Outlook add-ins already holding full read-write rights to the mailbox, uses them to obtain OAuth access tokens, and grants owner-level permissions over the victim’s folders to Exchange’s “Default” user. Because those permissions sit on the server, not the victim’s machine, changing the password or wiping the computer does not necessarily end the intrusion. The backdoor also seeds OWA’s offline cache with a poisoned message, so it can run again whenever that message is opened. It takes its orders from encrypted GitHub commit messages carrying the victim’s address and from specially formatted cached emails. It sends stolen data out through HTTPS routed via image delivery networks, with a direct-server fallback and an encrypted DNS channel. Proofpoint summed up the shift as a move from compromising individual webmail sessions to settling permanently inside the mailbox environment. Microsoft has issued fixes. The July 2026 Exchange update carries the code correction, and organisations that applied the earlier interim mitigation must remove it once patched. Only on-premises Exchange is affected, not Exchange Online. That is precisely why the targets matter. On-premises mail servers survive above all in public administrations and regulated or sensitive organisations, the institutions that keep their mail in-house for sovereignty or security reasons, and that are therefore the ones this campaign can reach.

Zimbra’s exposure did not end with the group’s old flaw. In August, CERT Polska confirmed active exploitation of CVE-2026-73570. This critical command-injection flaw lets an unauthenticated attacker run shell commands with the privileges of the Zimbra service account. It affects servers with SNMP trap notifications enabled and the swatchdog service running, which it is by default. Zimbra fixed it in version 10.1.20 on 20 July, and exploitation was confirmed twenty-eight days later. The Polish team published indicators of compromise and told administrators where to look: service status changes in the Zimbra log, and files recently created in Zimbra’s web application or temporary directories, where a web shell would give lasting access. Shadowserver counts more than 12,100 Zimbra servers reachable from the internet, roughly 4,400 in Europe and 4,500 in Asia, though the figure does not separate patched systems from vulnerable ones or real servers from decoys. When the advisory appeared, the flaw had not yet been added to CISA’s catalogue of known exploited vulnerabilities, which already lists eighteen Zimbra entries, four added this year. CERT Polska did not say who is behind the exploitation, and nothing in its advisory ties it to Laundry Bear. Its warning nonetheless came from the country that has made itself NATO’s most exposed and most watchful eastern frontier in cyberspace. It also lands on a platform with a long Russian record: Winter Vivern stealing NATO-aligned organisations’ mail through a Zimbra flaw in 2023, the US-UK warning in October 2024 that APT29 was targeting vulnerable Zimbra servers, and Seqrite’s March 2026 report of APT28 exploiting a stored flaw against Ukrainian government deployments.

Taken together, the three warnings describe a division of labour more than a single campaign. Russia’s intelligence services treat webmail as a standing collection platform, and they rotate actors, vulnerabilities and products while keeping the same objective. InfoSources has already traced how three other Russian clusters turned login screens into listening posts through app passwords, OAuth consent screens and device codes. Laundry Bear works the same terrain from the other side: through the mail server itself and the browser that renders it. For defenders, the lesson Proofpoint draws is uncomfortable. Responding to a suspected compromise now means auditing mailbox permissions, OAuth tokens and the browser’s offline storage, not just resetting a password and reimaging a laptop. For governments, the strategic point is sharper. The institutions that keep their mail on their own servers to protect it from foreign reach are, for now, the ones Russian services find easiest to read.