Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries | CyberScoop<\/title> <meta name=\"description\" content=\"U.S. and allied officials warn of Russian espionage group Laundry Bear exploiting a Zimbra zero-day vulnerability to steal sensitive email data.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/russian-laundry-bear-zimbra-exploit\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries\"> <meta property=\"og:description\" content=\"U.S. and allied officials warn of Russian espionage group Laundry Bear exploiting a Zimbra zero-day vulnerability to steal sensitive email data.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/russian-laundry-bear-zimbra-exploit\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2026-07-23T17:33:37+00:00\"> <meta property=\"article:modified_time\" content=\"2026-07-23T17:33:39+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg\"> <meta property=\"og:image:width\" content=\"2120\"> <meta property=\"og:image:height\" content=\"1414\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Matt Kapko\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@CyberScoopNews\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1784312972g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1784654430g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1782867887g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=9519dd464d894b805a10\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/89939\"><meta name=\"generator\" content=\"WordPress 6.8.6\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=89939\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Frussian-laundry-bear-zimbra-exploit%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Frussian-laundry-bear-zimbra-exploit%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-89939 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/russian-laundry-bear-zimbra-exploit\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"26.023404255319\">\n<div class=\"single-article__header-content\" readability=\"35.617582417582\">\n<p> Laundry Bear exploited a zero-day vulnerability for five months before it was patched in July 2025, and the group is still actively exploiting vulnerable environments. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/89939\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"427\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries.jpg?resize=640%2C427&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg 2120w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg?resize=2048,1366 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg?resize=505,337 505w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg?resize=1012,675 1012w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-2.jpg?resize=1264,843 1264w\" sizes=\"(max-width: 1012px) 100vw, 1012px\"><figcaption> (Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"44.096423211606\"><body readability=\"95.749539594843\"><\/p>\n<p>A Russian state-sponsored threat group has been stealing sensitive data from governments and commercial organizations since July 2025 via a novel exploit in popular Linux-based enterprise software, U.S. authorities and cyber officials from more than a dozen other countries warned in a <a href=\"https:\/\/media.defense.gov\/2026\/Jul\/22\/2003965244\/-1\/-1\/1\/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF\">joint cybersecurity advisory<\/a> Thursday.<\/p>\n<p>Laundry Bear\u2019s most recent espionage campaign involves the exploitation of a zero-day vulnerability in Zimbra Collaboration Suite that wasn\u2019t patched until November 2025, five months after attacks were well underway, officials said. <\/p>\n<p>The exploit just requires a view \u2014 no clicks \u2014 and allows attackers to steal the previous 90 days\u2019 worth of email, the account\u2019s password, search history, the victim organization\u2019s email directory, two-factor authentication tokens and other newly created passwords.<\/p>\n<p>\u201cThe covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group\u2019s involvement in espionage activities with Russian government backing,\u201d officials wrote in the advisory. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cAdditionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first\u2014both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.\u201d<\/p>\n<p>The state-sponsored espionage group, also known as Void Blizzard, has compromised governments and organizations in the defense, education, energy, law enforcement, media, finance, transportation and technology sectors. <\/p>\n<p>Laundry Bear\u2019s year-long campaign involving the exploitation of <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-66376\">CVE-2025-66376<\/a> showcases more technical capabilities, including a custom JavaScript payload it delivers to targeted victims via phishing emails. The threat group could also likely adapt the novel data exfiltration and aggregation capability, dubbed \u201cbeehive,\u201d to exploit other vulnerabilities, officials warned.<\/p>\n<p>The defect\u2019s medium-severity rating of 6.1 underscores the challenge defenders regularly confront in prioritizing patching schedules based on measure of severity alone.<\/p>\n<p>The Russian state-supported group, which has been active since at least 2024, is still actively exploiting Zimbra Collaboration Suite instances that remain unpatched, officials said.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Authorities shared Thursday indicators of compromise, mitigation steps and urged organizations to update their vulnerable software.<\/p>\n<p>\u201cThis campaign\u2019s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations\u201d by identifying organizations with public-facing infrastructure, officials wrote in the advisory.<\/p>\n<p>Once a target is identified, Laundry Bear also likely compiles email addresses for users to target with the exploit via phishing emails. Officials did not identify specific victims or describe the volume of organizations already compromised.<\/p>\n<p>The joint cybersecurity advisory was issued by the United States, Australia, Canada, New Zealand, the United Kingdom, Czech Republic, Denmark, Estonia, Finland, France, Italy, Moldova, the Netherlands, Poland, Spain and Sweden.<\/p>\n<p> <\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"2.5453315290934\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries-1.jpg?w=640&ssl=1\" alt=\"Matt Kapko\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Kapko<\/h4>\n<p> Matt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/russian-laundry-bear-zimbra-exploit\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Russian espionage group using novel Zimbra exploit to steal sensitive<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[436,2785,2786,1753,78,452,4429,1367,624,4072,669,4894,2161,302,117,3928,6847,2713,2814,7140,60,2048,256,270,2730,2757,5693,288,354,971,1544,5292,2873],"tags":[245,2789,2790,1756,86,454,4430,1368,629,4080,671,4896,2164,306,119,3930,6849,2716,2821,7141,67,2053,262,276,2738,2758,5695,294,358,973,1545,5296,2878],"class_list":["post-8858","post","type-post","status-publish","format-standard","hentry","category-apt","category-australia","category-canada","category-cyber-espionage","category-cybersecurity","category-cybersecurity-and-infrastructure-security-agency-cisa","category-czech-republic","category-denmark","category-espionage","category-estonia","category-federal-bureau-of-investigation-fbi","category-finland","category-france","category-geopolitics","category-government","category-italy","category-laundry-bear","category-moldova","category-new-zealand","category-payload","category-phishing","category-poland","category-research","category-russia","category-spain","category-sweden","category-the-netherlands","category-threats","category-ukraine","category-united-kingdom-u-k","category-zero-day","category-zero-day-exploit","category-zimbra","tag-apt","tag-australia","tag-canada","tag-cyber-espionage","tag-cybersecurity","tag-cybersecurity-and-infrastructure-security-agency-cisa","tag-czech-republic","tag-denmark","tag-espionage","tag-estonia","tag-federal-bureau-of-investigation-fbi","tag-finland","tag-france","tag-geopolitics","tag-government","tag-italy","tag-laundry-bear","tag-moldova","tag-new-zealand","tag-payload","tag-phishing","tag-poland","tag-research","tag-russia","tag-spain","tag-sweden","tag-the-netherlands","tag-threats","tag-ukraine","tag-united-kingdom-u-k","tag-zero-day","tag-zero-day-exploit","tag-zimbra"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/apt\/\" rel=\"category tag\">apt<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/australia\/\" rel=\"category tag\">Australia<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/canada\/\" rel=\"category tag\">Canada<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cyber-espionage\/\" rel=\"category tag\">cyber espionage<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity-and-infrastructure-security-agency-cisa\/\" rel=\"category tag\">Cybersecurity and Infrastructure Security Agency (CISA)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/czech-republic\/\" rel=\"category tag\">Czech Republic<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/denmark\/\" rel=\"category tag\">Denmark<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/espionage\/\" rel=\"category tag\">espionage<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/estonia\/\" rel=\"category tag\">Estonia<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/finland\/\" rel=\"category tag\">Finland<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/france\/\" rel=\"category tag\">France<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/geopolitics\/\" rel=\"category tag\">Geopolitics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/government\/\" rel=\"category tag\">Government<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/italy\/\" rel=\"category tag\">Italy<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/laundry-bear\/\" rel=\"category tag\">Laundry Bear<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/moldova\/\" rel=\"category tag\">Moldova<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/new-zealand\/\" rel=\"category tag\">New Zealand<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/payload\/\" rel=\"category tag\">payload<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/phishing\/\" rel=\"category tag\">phishing<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/poland\/\" rel=\"category tag\">Poland<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/research\/\" rel=\"category tag\">Research<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/russia\/\" rel=\"category tag\">Russia<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/spain\/\" rel=\"category tag\">Spain<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/sweden\/\" rel=\"category tag\">Sweden<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/the-netherlands\/\" rel=\"category tag\">The Netherlands<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ukraine\/\" rel=\"category tag\">Ukraine<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/united-kingdom-u-k\/\" rel=\"category tag\">United Kingdom (U.K.)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/zero-day\/\" rel=\"category tag\">Zero-day<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/zero-day-exploit\/\" rel=\"category tag\">zero-day exploit<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/zimbra\/\" rel=\"category tag\">Zimbra<\/a>","tag_info":"Zimbra","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8858","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=8858"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8858\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=8858"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=8858"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=8858"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":8858,"date":"2026-07-23T12:33:37","date_gmt":"2026-07-23T17:33:37","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=89939"},"modified":"2026-07-23T12:33:37","modified_gmt":"2026-07-23T17:33:37","slug":"russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2026\/07\/23\/russian-espionage-group-using-novel-zimbra-exploit-to-steal-sensitive-data-from-western-countries\/","title":{"rendered":"Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries"},"content":{"rendered":"