eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Espionage Campaign Targeting Zimbra Collaboration Suite Linked to Russian APT
Bottom Line: Russian APT group LAUNDRY BEAR is exploiting CVE-2025-66376, a zero-click XSS vulnerability in Zimbra Collaboration Suite webmail, to exfiltrate data and establish persistent account access across Western government, defense, energy, and NGO targets.
On July 23rd, 2026, CISA and multiple international cybersecurity and intelligence agencies published a joint advisory detailing an ongoing cyber espionage campaign conducted by the Russian state-supported threat group known as LAUNDRY BEAR. The campaign targets organizations using the Zimbra Collaboration Suite (ZCS) webmail platform and employs the vulnerability, CVE-2025-66376, to compromise user accounts and steal sensitive information.
LAUNDRY BEAR, also known as Void Blizzard, CL-STA-1114, and TA488, is a Russian state-supported advanced persistent threat (APT) group that has been conducting cyber espionage activities since at least 2024. The group’s activities are intended to support Russian intelligence collection efforts.
The campaign has affected a broad range of organizations across Western nations. Targeted sectors include Defense Industrial Base, federal and local government agencies, education, energy, law enforcement, media, technology, and non-governmental organizations.
The attack begins when a malicious email is delivered to a user of a vulnerable Zimbra webmail environment. The email contains a specially crafted JavaScript payload embedded within an SVG image and disguised using multiple layers of obfuscation, including Base64 encoding and XOR encryption. The payload exploits CVE-2025-66376, a cross-site scripting vulnerability caused by improper sanitization of CSS @import directives within email content. When the victim views the email, the malicious script executes automatically within the context of the user’s authenticated Zimbra session. The exploit was first used as a zero-day vulnerability beginning in July 2025, months before a patch was released and before public disclosure occurred in January 2026.
To facilitate the operation, LAUNDRY BEAR developed a custom collection capability known as “Ulej”, which translates to “Beehive” in Russian. “Ulej” is specifically designed to target Zimbra environments and automate the collection and exfiltration of information from compromised accounts. The malware executes a series of collection stages that harvest user credentials, email communications, authentication data, and organizational information.
The malware attempts to collect the victim’s email address, the last ninety days of email communications, the organization’s Global Address List (GAL), saved passwords, OAuth application information, device information, 2FA recovery codes, and newly generated application-specific passwords. The collected information is then transmitted to attacker-controlled infrastructure for long-term storage and analysis. Following successful execution, the malware attempts to establish persistent access to the victim’s mailbox.
eSentire Threat Intelligence Analysis:
The LAUNDRY BEAR campaign highlights the continuing evolution of Russian state-sponsored cyber espionage operations and underscores the significant risks posed by vulnerabilities in enterprise email platforms. By leveraging the zero-day vulnerability CVE-2025-66376, the threat actor was able to compromise Zimbra users through the simple act of viewing a malicious email, eliminating the need for traditional user interaction and increasing the likelihood of successful exploitation. Once access was established, the attackers systematically collected sensitive information while implementing mechanisms to maintain persistent access to victim accounts.
The campaign’s focus on government entities, defense organizations, critical infrastructure sectors, and technology companies demonstrates a clear intelligence-gathering objective consistent with Russian strategic interests. Additional technical analysis from Palo Alto Networks Unit 42 and Proofpoint independently corroborates the findings outlined in the CISA advisory, providing further insight into LAUNDRY BEAR (TA488) operations, infrastructure, and exploitation of Zimbra webmail environments.
Organizations operating ZCS should treat this threat as a high-priority risk and implement the recommended mitigations. Immediate patching of vulnerable systems, thorough threat hunting for indicators of compromise, revocation of unauthorized application passwords, and enhanced monitoring of email infrastructure are essential to reducing the risk of compromise. Given LAUNDRY BEAR’s history of targeting Western organizations, defenders should anticipate continued attempts to exploit email systems and proactively strengthen both detection and mitigation capabilities.
The eSentire Threat Intelligence team continues to track activity associated with Russian state-sponsored threat actors. eSentire Managed Vulnerability Service has plugins in place to identify devices vulnerable to CVE-2025-66376.
Microsoft's Q2 2026 Phishing Threat Landscape Report
Bottom Line: Microsoft has released their 2026 Q2 Phishing Landscape report, identifying shifts in threat actor phishing activity and the impact of the Q1 disruption against Tycoon2FA.
On July 23rd, 2026, Microsoft published their Q2 2026 email threat landscape report, highlighting trends that have been observed in phishing-related attacks between April - June 2026. The report indicates that over 7.6 billion email-based phishing threats were observed during this timeframe, with credential phishing being the most dominant objective. High-volume campaigns that leveraged Python libraries and the Amazon Simple Email Service (SES) API were also identified, enabling a threat actor to send phishing emails to over 67,000 users across 42,000 organizations, spanning numerous industries, in a three-hour window.
The most notable trends identified by Microsoft within their report are the decrease in activity linked to Tycoon2FA and increase in Microsoft Teams-based phishing. During this timeframe, Microsoft highlights a drop in Tycoon2FA phishing activity, which they indicate seeing an average monthly volume of Tycoon2FA-linked phishing messages of 15 million during the second half of 2025. Following the disruption of the Tycoon2FA Phishing-as-a-Service (PhaaS) platform in March 2026, Microsoft noted a 90% decline in attacks leveraging Tycoon2FA by the end of June.
A spike in Microsoft Teams-based phishing was demonstrated with a 19% increase from March to April, and another 10% increase from May to June. The dominant lure in these phishing attacks continued to be technical support impersonation, but Microsoft noted that attackers began to shift away from identities disguised as IT Support or helpdesk, and more towards generic display names. Voice phishing (vishing) attacks over Teams increased as well, ten-times more than the mid-2025 baseline. The attackers appear to deliberately time calls to when targets in North America are most likely to be online, with the most activity between 14:00 - 20:00 UTC (10:00 - 16:00 EDT), Monday to Friday.
eSentire Threat Intelligence Analysis:
The disruption of Tycoon2FA infrastructure in March 2026 saw a drastic decline in the phishing kits activity, as its developers attempted to rebuild operations. eSentire's Threat Response Unit (TRU) published findings in April 2026, highlighting changes that were made to Tycoon2FA following the actions taken by Microsoft. The resilience of its operators is a trend that has been seen with other Cybercrime-as-a-Service (CaaS) ecosystems, such as Lumma Stealer surviving similar setbacks. Tycoon2FA and Lumma Stealer surviving these takedowns demonstrate that while these disruptions can have immediate effects in terms of observed activity, these impacts may only be temporary, as these tools are often built back up over time.
Microsoft also highlighted an increase in Microsoft Teams-based phishing and impersonation attacks, when compared to levels observed in 2025. eSentire has also observed similar trends in IT Support and helpdesk impersonation attacks over Teams, when compared to observations of the technique in 2025. The tactic has been reported on throughout 2026 and has been used by threat actors such as Silent Ransom Group, Payouts King, and UNC6692, or used to deploy malware such as ModeloRAT. The attacks effectiveness is likely one of the reasons why it’s become adopted by several threat actors, with Microsoft also assessing its large impact due to Teams messages bypassing secure email gateways, and “benefits from the perceived legitimacy of a colleague-initiated chat”. eSentire's Threat Intelligence team assesses with high confidence that Teams-based impersonation and vishing will continue to be a prominent attack vector in 2026.
To protect against these threats, organizations should conduct Phishing and Security Awareness Training (PSAT), which can be used to educate users on how to identify and report malicious content. Organizations should also restrict Microsoft Teams messages and calls from external organizations, unless specifically required. Users should also be made aware of organizational policies for contacting internal support teams and have processes to verify unexpected IT requests through secondary, trusted channels. Remote Monitoring and Management (RMM) tools, which are often deployed as part of Teams-based vishing attacks, should also be restricted if not legitimately used. eSentire’s TRU discussed Teams-based vishing further in the July 2026 TRU Intelligence Briefing.
CISA Updates Advisory on Iranian APTs Targeting PLCs in the United States
Bottom Line: CISA has updated an advisory, confirming that Iranian-affiliated threat actors continue to target Programable Logic Controllers (PLCs) across U.S. critical infrastructure.
On July 22nd, 2026, CISA, in coordination with the FBI, NSA, EPA, Department of Energy, CNMF, and Department of Treasury, updated the April 2026 joint advisory (AA26-097A) on Iranian-affiliated threat actors targeting Programmable Logic Controllers (PLCs) across critical infrastructure, including energy and water systems, within the United States. The update expands confirmed targeting beyond Rockwell Automation to include Schneider Electric and Siemens devices. Attacks have caused confirmed operational disruption and financial loss. Observed activity involved disabling safety shutdown and alarm logic, allowing industrial systems to enter unsafe physical conditions without operator awareness.
The confirmed targeted PLC models include Rockwell Automation CompactLogix and Micro850 controllers, Schneider Electric Modicon M340 (BMX P34), and Siemens S7-1200 series devices. The threat actors do not exploit any known software vulnerabilities; instead, they leverage PLCs that are directly exposed to the Internet without proper authentication gating or network segmentation. In some observed attacks, the adversaries deployed Dropbear SSH, a lightweight open-source SSH implementation used in embedded Linux environments, providing persistent remote access capable of surviving device reboots.
Once connected, the threat actors extracted PLC project files containing ladder logic, control sequences, and configuration parameters, providing a detailed blueprint of the target’s industrial processes. The project logic was retained for downstream function, but the actors added Add-On Instructions (AOIs) and modified control logic to override the specific instruction sets responsible for maintaining safe operating parameters. Critically, the changes disabled shutdown and alarm logic, the safety mechanisms designed to detect abnormal conditions and alert operators before equipment failure or physical harm can occur. This allowed systems to “enter unsafe conditions without notifying operators of the anomalies.” In parallel, the actors falsified the values displayed on Human Machine Interface (HMI) and SCADA screens, meaning that even if operators were monitoring the system, they would see normal readings while the underlying physical process was operating outside safe parameters. The authoring agencies confirmed these attacks have caused operational disruption and direct financial loss to victim organizations.
The advisory attributes the targeting of PLCs to Iranian affiliated APT groups and specifically notes that the Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC) actors, operating under the hacktivist persona CyberAv3ngers (also tracked as Shahid Kaveh Group, Hydro Kitten, Storm-0784, and UNC5691) have previously conducted similar activity.
eSentire Threat Intelligence Analysis:
The updated advisory signals a broader pattern in which Iranian-affiliated actors are deliberately expanding their Operational Technologies (OT) targeting capabilities in scope, technique sophistication, and vendor coverage, raising the strategic risk to critical infrastructure operators. Iranian threat actors may use access to PLCs to cause destructive outcomes immediately or establish persistence for use at a future date. According to a report from Recorded Future, during the U.S.-Iran ceasefire, Iranian cyber activity pivoted to domestic control. As the ceasefire has ended and kinetic attacks are resumed, it is highly likely that Iranian APT groups are re-focused on U.S. and Israeli targets.
Critical infrastructure owners outside the water and energy sectors should not treat this advisory as sector-specific; CISA notes that potentially all Internet-exposed PLCs are at risk regardless of manufacturer. Organizations operating Internet-connected OT environments should treat this advisory as directly relevant. The July 22nd update is a material expansion: new vendor coverage, new detection guidance, and updated Indicators of Compromise (IoCs) all represent actionable information for defenders.
eSentire's Threat Intelligence team covered the original CISA report in the April 8th Daily Threat Briefing. This year, eSentire’s Threat Response Unit (TRU) has published two separate advisories on Iranian APT activity; recommendations included in these advisories remain relevant today.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
