Date: 07/27/2026
Severity: Critical
Summary
Since at least July 2025, the Russian state-backed APT group LAUNDRY BEAR has targeted Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS). The group's primary objective is to covertly collect sensitive email data for the Russian Federation. Earlier campaigns relied on techniques such as password spraying, phishing, and pass-the-cookie attacks to gain initial access. In its latest campaign, LAUNDRY BEAR adopted a previously unknown zero-day vulnerability in ZCS, demonstrating more advanced capabilities. The flaw, tracked as CVE-2025-66376, was actively exploited before being patched in November 2025. This shift highlights the group's increasing technical sophistication and continued focus on high-value intelligence collection.
Indicators of Compromise (IOC) List
Domains/URLs | zmailanalytics.com zimbra-metadata.com analyticemailmeter.com emailanalytics.com.ua mailnalysis.com zimbrastat.com zimbrasoft.com.ua synacorzimbra.nl istc-cloud.com zmailanalytics.com i.zmailanalytics.com i.zimbra-metadata.com i.analyticemailmeter.com i.emailanalytics.com.ua i.mailnalysis.com i.zimbrastat.com i.zimbrasoft.com.ua i.synacorzimbra.nl i.istc-cloud.com |
IP Address | 216.252.238.104 216.252.238.18 37.120.247.228 185.86.79.95 104.248.134.194 64.226.124.190 193.238.152.66 216.252.238.64 194.156.103.193 |
Hash | 2e4f314bc9943cab5005d6fde0b271c74d47bc9d
50a87d926621dd06389ba50d86e0ff574ed713a8
c5a72420e7bb308d078e62128430897f82194c95
8959c4d29e29f02ea94ea8bb21c8df2594c5549d
62eb76432597694edb01c1fe57aab0cfe03a7178
cddf5c3be1e07f28140aed165b929bf2d614922a
18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8
1b25041ececf2457eef0270fc1d785cec8ec9ded
e4fe6466a4f9a4249fe330651e914e45bbdca44a
b6b77c9a455225d525834a403ca9ef5481ed0447
98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf
60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874
b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d
1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760
|
Email Address | ivanka.zurabishvili@proton.me zmul1@buildandconsulting.com garrysmithme@pinmx.net hostingclient@pinmx.net c.laurent.ejfa@proton.me j.moreau.epsc@proton.me liberty.insights@proton.me |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "i.emailanalytics.com.ua" or url like "i.emailanalytics.com.ua" or siteurl like "i.emailanalytics.com.ua" or domainname like "i.zimbrasoft.com.ua" or url like "i.zimbrasoft.com.ua" or siteurl like "i.zimbrasoft.com.ua" or domainname like "i.analyticemailmeter.com" or url like "i.analyticemailmeter.com" or siteurl like "i.analyticemailmeter.com" or domainname like "i.synacorzimbra.nl" or url like "i.synacorzimbra.nl" or siteurl like "i.synacorzimbra.nl" or domainname like "i.zimbra-metadata.com" or url like "i.zimbra-metadata.com" or siteurl like "i.zimbra-metadata.com" or domainname like "i.zmailanalytics.com" or url like "i.zmailanalytics.com" or siteurl like "i.zmailanalytics.com" or domainname like "i.zimbrastat.com" or url like "i.zimbrastat.com" or siteurl like "i.zimbrastat.com" or domainname like "mailnalysis.com" or url like "mailnalysis.com" or siteurl like "mailnalysis.com" or domainname like "i.mailnalysis.com" or url like "i.mailnalysis.com" or siteurl like "i.mailnalysis.com" or domainname like "zimbrasoft.com.ua" or url like "zimbrasoft.com.ua" or siteurl like "zimbrasoft.com.ua" or domainname like "i.istc-cloud.com" or url like "i.istc-cloud.com" or siteurl like "i.istc-cloud.com" or domainname like "zimbrastat.com" or url like "zimbrastat.com" or siteurl like "zimbrastat.com" or domainname like "istc-cloud.com" or url like "istc-cloud.com" or siteurl like "istc-cloud.com" or domainname like "synacorzimbra.nl" or url like "synacorzimbra.nl" or siteurl like "synacorzimbra.nl" or domainname like "zmailanalytics.com" or url like "zmailanalytics.com" or siteurl like "zmailanalytics.com" or domainname like "zmailanalytics.com" or url like "zmailanalytics.com" or siteurl like "zmailanalytics.com" or domainname like "zimbra-metadata.com" or url like "zimbra-metadata.com" or siteurl like "zimbra-metadata.com" or domainname like "analyticemailmeter.com" or url like "analyticemailmeter.com" or siteurl like "analyticemailmeter.com" or domainname like "emailanalytics.com.ua" or url like "emailanalytics.com.ua" or siteurl like "emailanalytics.com.ua" |
Detection Query 2 : | dstipaddress IN ("64.226.124.190","193.238.152.66","194.156.103.193","216.252.238.18","216.252.238.104","216.252.238.64","104.248.134.194","37.120.247.228","185.86.79.95") or srcipaddress IN ("64.226.124.190","193.238.152.66","194.156.103.193","216.252.238.18","216.252.238.104","216.252.238.64","104.248.134.194","37.120.247.228","185.86.79.95") |
Detection Query 3 : | sha256hash IN ("60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874","1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760","98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf","b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d")
|
Detection Query 4 : | sha1hash IN ("2e4f314bc9943cab5005d6fde0b271c74d47bc9d","50a87d926621dd06389ba50d86e0ff574ed713a8","c5a72420e7bb308d078e62128430897f82194c95","8959c4d29e29f02ea94ea8bb21c8df2594c5549d","62eb76432597694edb01c1fe57aab0cfe03a7178","cddf5c3be1e07f28140aed165b929bf2d614922a","18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8","1b25041ececf2457eef0270fc1d785cec8ec9ded","e4fe6466a4f9a4249fe330651e914e45bbdca44a","b6b77c9a455225d525834a403ca9ef5481ed0447")
|
Detection Query 5 : | sender IN ("ivanka.zurabishvili@proton.me","zmul1@buildandconsulting.com","garrysmithme@pinmx.net","hostingclient@pinmx.net","c.laurent.ejfa@proton.me","j.moreau.epsc@proton.me","liberty.insights@proton.me") or from IN ("ivanka.zurabishvili@proton.me","zmul1@buildandconsulting.com","garrysmithme@pinmx.net","hostingclient@pinmx.net","c.laurent.ejfa@proton.me","j.moreau.epsc@proton.me","liberty.insights@proton.me") or recipient IN ("ivanka.zurabishvili@proton.me","zmul1@buildandconsulting.com","garrysmithme@pinmx.net","hostingclient@pinmx.net","c.laurent.ejfa@proton.me","j.moreau.epsc@proton.me","liberty.insights@proton.me") |
Reference:
https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a