Jul 24 – July 30, 2026 · 4 reports
- TA488 (Laundry Bear / Void Blizzard) is exploiting an Outlook Web Access XSS zero-day (CVE-2026-42897) for persistent mailbox access (earlier coverage). Proofpoint says the Russia-aligned actor began the campaign on July 22, targeting US and European government, telecom, financial, hospitality and aerospace orgs, and is doubling down on "half-click" exploits where merely opening the email triggers compromise. Proofpoint, The Record · Jul 30 · observed · via phishing email · as ta488, laundry bear · Threat Activity
- Russia's Laundry Bear (Void Blizzard / TA488) campaign against Zimbra got a technical anatomy from Unit 42, tracking it as CL-STA-1114: the zero-click XSS payload (CVE-2025-66376) grabs the last 90 days of mail, the org's full email directory, browser-saved passwords, and 2FA recovery codes the moment a message loads, per The Hacker News and BleepingComputer (earlier coverage). · Jul 26 · observed · as laundry bear, ta488 · Threat Activity
- Russian Zimbra campaign broadens across webmail platforms. Proofpoint expands the picture on the state-linked actor (TA488 / Void Blizzard / Laundry Bear), tying the "half-click" Zimbra XSS (CVE-2025-66376) to a wider Operation RoundPress push that also weaponized zero-days in mDaemon (CVE-2025-3929) and SOGo (CVE-2026-8496) (earlier coverage). Proofpoint. · Jul 25 · observed · as ta488 · Threat Activity
- A US/UK-led coalition exposed a Russian state campaign exploiting Zimbra zero-click flaw CVE-2025-66376 against NATO, Ukraine, CIS and African targets. The actor — tracked as Laundry Bear / Void Blizzard / TA488 (CL-STA-1114) — plants malicious JavaScript that fires the instant a webmail message is previewed, no click required; its Ulej tool then exfiltrates the last 90 days of email, org directories, saved browser passwords, and 2FA recovery codes. CISA advisory, NCSC-UK, Unit 42, The Record. · Jul 24 · observed · via phishing email · as laundry bear, ta488 · Threat Activity