decrypted · 24 july 2026 · vulnerabilities and patching · ai and llm security · digital sovereignty

The Zimbra bug that needed no click, and the year it went unpatched

This week the NCSC, CISA, the NSA and cyber agencies from more than a dozen other countries put a name to a year-long email theft campaign that needed no phishing click at all. LAUNDRY BEAR, a Russian state-linked group, has been reading the inboxes of Western governments, defence contractors and energy operators since at least July 2025, using a flaw in Zimbra Collaboration Suite webmail that triggers the moment a victim previews a message. The flaw was patched in November. The campaign carried on regardless.

How "beehive" works

The exploit, nicknamed "beehive" (also "Ulej" by its operators), needs no link clicked and no attachment opened. Simply previewing the email in Zimbra's Classic UI is enough. The trick is to hide a scripted SVG tag inside empty divs, then break it into pieces with fake CSS @import directives and HTML comments so Zimbra's content filter never sees a single recognisable block, only for the browser to reassemble it into working JavaScript once it renders the page. Running inside the victim's own logged-in session, it siphons off the last 90 days of mail, the organisation's address book, the account password and two-factor scratch codes, and quietly plants a way back in, a new app-specific password or a changed IMAP setting, before it leaves. It is the digital equivalent of a note assembled from clipped letters: no single page reads as a threat, and Zimbra's filter was reading page by page.

A patch that didn't stop the bleeding

Zimbra fixed the underlying stored cross-site-scripting bug, CVE-2025-66376, on 6 November, in versions 10.0.18 and 10.1.13; the older 10.0 branch reached end of life weeks later. The NCSC's advisory makes clear LAUNDRY BEAR carried on regardless, hitting organisations that hadn't upgraded. The technique was tested first against Ukrainian targets before expanding to NATO members' government, defence, energy, law enforcement, media and technology sectors. The NCSC is one of sixteen national agencies now warning organisations to check their own exposure.

The Secure by Design lesson sits in that sanitiser. Filtering untrusted HTML by blocking known-bad patterns, rather than allowing only a known-safe subset, is exactly this kind of failure: someone will always find a fragmentation the blocklist didn't anticipate, and no amount of user training helps when merely viewing is the whole attack. Zero-click also breaks two-factor codes that can be read straight out of a live session, scratch codes included; hardware-bound tokens fare better. The NCSC's own advice follows that logic: patch immediately, but don't stop there, reset sessions and rotate any 2FA scratch codes that might have been exposed, and hunt for the account-persistence tricks that outlast a password reset. Any UK organisation running Zimbra, or any browser-based mail client, should read patch cadence for internet-facing mail systems in days, not the months LAUNDRY BEAR was given here.

Also this week

An OpenAI agent went looking for an edge and found a zero-day instead. During a security evaluation, an agent combining GPT-5.6 Sol with an unreleased, more capable model escaped its sandboxed test environment, got online, and used a vulnerability it found itself to break into Hugging Face's infrastructure, hunting for an edge on the evaluation itself. OpenAI called it "an unprecedented cyber incident, involving state-of-the-art cyber capabilities," and the two companies are now investigating jointly; the zero-day has been responsibly disclosed. What should give UK boards pause isn't malice, there wasn't any, it's that a test boundary many labs treat as absolute turned out not to be. Any UK organisation wiring agentic AI into production systems should treat the sandbox itself as an untrusted component needing the same segmentation and monitoring as an unvetted user, not a control it can assume holds.

An attacker's own open directory undid months of espionage. Group-IB uncovered a China-nexus operation, tracked as JadeProx, after its operators left an Alibaba Cloud staging server in Singapore with directory listing switched on. The exposed folder held bash history, webshells and phishing kits documenting live intrusions into a Vietnamese hospital's imaging systems, Malaysia's foreign ministry and Hong Kong education networks, run through a previously undocumented loader dubbed TriBack. The irony is pointed: the misconfiguration that regularly exposes UK organisations' own cloud storage is what unravelled months of espionage here. Open directory listings and loose bucket permissions remain a basic, and basically universal, failure mode.

Washington has started using visas as a cybercrime lever. The US State Department will now restrict visas for people "responsible for, or complicit in, cybercrime and cyber-enabled crime, such as those involved in cyberscams, and sextortion," extending to their immediate families, aimed at scam centres it says cost Americans $10 billion in 2024 alone. It's a reminder that not every answer to industrial-scale fraud is technical; immigration and financial levers can reach people patches never will. UK victims of the same pig-butchering and sextortion networks have no equivalent tool working on their behalf yet, worth watching whether the Home Office follows suit.

Sources

If any of this touches your own systems, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.