--- title: "LAUNDRY BEAR: UK and Allies Expose Russian Stat… | Firevault" description: "The NCSC and 15 partner agencies have exposed LAUNDRY BEAR, a Russian state-supported group using a zero-click exploit called "beehive" to silently steal…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/laundry-bear-zimbra-zero-click-2026#webpage", "url": "https://fire-vault.com/news/laundry-bear-zimbra-zero-click-2026", "name": "LAUNDRY BEAR: UK and Allies Expose Russian Stat…", "description": "The NCSC and 15 partner agencies have exposed LAUNDRY BEAR, a Russian state-supported group using a zero-click exploit called \"beehive\" to silently steal…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/28cfcb92-3f05-457f-818d-a80a7e67d678/laundry-bear-zimbra-zero-click-2026-2x.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/laundry-bear-zimbra-zero-click-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/laundry-bear-zimbra-zero-click-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "LAUNDRY BEAR: UK and Allies Expose Russian State-Supported Zero-Click Email Attack on Zimbra", "item": "https://fire-vault.com/news/laundry-bear-zimbra-zero-click-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "LAUNDRY BEAR: UK and Allies Expose Russian State-Supported Zero-Click Email Attack on Zimbra", "description": "The NCSC and 15 partner agencies have exposed LAUNDRY BEAR, a Russian state-supported group using a zero-click exploit called \"beehive\" to silently steal email from Western organisations running Zimbra Collaboration Suite. The user only needs to open a message. No click, no attachment, no warning.", "url": "https://fire-vault.com/news/laundry-bear-zimbra-zero-click-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/28cfcb92-3f05-457f-818d-a80a7e67d678/laundry-bear-zimbra-zero-click-2026-2x.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/28cfcb92-3f05-457f-818d-a80a7e67d678/laundry-bear-zimbra-zero-click-2026-2x.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/28cfcb92-3f05-457f-818d-a80a7e67d678/laundry-bear-zimbra-zero-click-2026-2x.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/__l5e/assets-v1/28cfcb92-3f05-457f-818d-a80a7e67d678/laundry-bear-zimbra-zero-click-2026-2x.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-07-24T09:00:00+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/laundry-bear-zimbra-zero-click-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 989, "keywords": "LAUNDRY, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "On 23 July 2026 the UK's National Cyber Security Centre, part of GCHQ, alongside cyber agencies in 15 partner countries, publicly attributed a long-running email theft campaign to a Russian state-supported group known as LAUNDRY BEAR . The group has been using a zero-click exploit named beehive (in Russian, Ulej ) to compromise Zimbra Collaboration Suite (ZCS) webmail and quietly pull out sensitiv", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview What happenedWhy "zero-click" mattersWho has been namedWhat UK officials are sayingThe AI angleThe wider patternWhat organisations should do nowThe Firevault viewSourcesMore Resources [Knowledge Vault](/learn/knowledge)/ [News](/learn/knowledge?filter=news) News · Breach Analysis · 24 July 2026 # LAUNDRY BEAR: UK and Allies Expose Russian State-Supported Zero-Click Email Attack on Zimbra The NCSC and 15 partner agencies have exposed LAUNDRY BEAR, a Russian state-supported group using a zero-click exploit called "beehive" to silently steal email from Western organisations running Zimbra Collaboration Suite. The user only needs to open a message. No click, no attachment, no warning. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 5 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Flaundry-bear-zimbra-zero-click-2026)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Flaundry-bear-zimbra-zero-click-2026&text=LAUNDRY%20BEAR%3A%20UK%20and%20Allies%20Expose%20Russian%20State-Supported%20Zero-Click%20Email%20Attack%20on%20Zimbra%0A%0AThe%20NCSC%20and%2015%20partner%20agencies%20have%20exposed%20LAUNDRY%20BEAR%2C%20a%20Russian%20state-supported%20group%20using%20a%20zero-click%20exploit%20called%20%22beehive%22%20to%20silently%20steal%20email%20from%20Western%20organisations%20running%20Zimbra%20Collaboration%20Suite.%20The%20user%20only%20needs%20to%20open%20a%20message.%20No%20click%2C%20no%20attachment%2C%20no%20warning.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Flaundry-bear-zimbra-zero-click-2026)[](mailto:?subject=LAUNDRY%20BEAR%3A%20UK%20and%20Allies%20Expose%20Russian%20State-Supported%20Zero-Click%20Email%20Attack%20on%20Zimbra&body=The%20NCSC%20and%2015%20partner%20agencies%20have%20exposed%20LAUNDRY%20BEAR%2C%20a%20Russian%20state-supported%20group%20using%20a%20zero-click%20exploit%20called%20%22beehive%22%20to%20silently%20steal%20email%20from%20Western%20organisations%20running%20Zimbra%20Collaboration%20Suite.%20The%20user%20only%20needs%20to%20open%20a%20message.%20No%20click%2C%20no%20attachment%2C%20no%20warning.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Flaundry-bear-zimbra-zero-click-2026) ![Editorial illustration of a glowing email envelope releasing swarm particles against a dark navy background with faint Kremlin silhouettes, representing the LAUNDRY BEAR zero-click email attack.](/__l5e/assets-v1/28cfcb92-3f05-457f-818d-a80a7e67d678/laundry-bear-zimbra-zero-click-2026-2x.jpg) Editorial illustration of a glowing email envelope releasing swarm particles against a dark navy background with faint Kremlin silhouettes, representing the LAUNDRY BEAR zero-click email attack. Why it matters ## What this means for organisations holding critical data The NCSC and 15 partner agencies have exposed LAUNDRY BEAR, a Russian state-supported group using a zero-click exploit called "beehive" to silently steal email from Western organisations running Zimbra Collaboration Suite. The user only needs to open a message. No click, no attachment, no warning. In this analysis 1. 01 [What happened](#section-0) 2. 02 [Why "zero-click" matters](#section-1) 3. 03 [Who has been named](#section-2) 4. 04 [What UK officials are saying](#section-3) 5. 05 [The AI angle](#section-4) 6. 06 [The wider pattern](#section-5) **On this page**[What happened](#section-0)[Why "zero-click" matters](#section-1)[Who has been named](#section-2)[What UK officials are saying](#section-3)[The AI angle](#section-4)[The wider pattern](#section-5)[What organisations should do now](#section-6)[The Firevault view](#section-7) On 23 July 2026 the UK's National Cyber Security Centre, part of GCHQ, alongside cyber agencies in 15 partner countries, publicly attributed a long-running email theft campaign to a Russian state-supported group known as **LAUNDRY BEAR**. The group has been using a zero-click exploit named _beehive_ (in Russian, _Ulej_) to compromise Zimbra Collaboration Suite (ZCS) webmail and quietly pull out sensitive email, according to the joint advisory. ## What happened Since July 2025, LAUNDRY BEAR has targeted Western organisations that run vulnerable versions of Zimbra Collaboration Suite. Confirmed US targets sit across defence, government, education, energy, law enforcement, media, NGOs and technology, according to the NCSC statement. The technique was trialled against Ukrainian victims first, then turned on NATO members, a pattern the agencies say is now typical of Russian state cyber activity. ## Why "zero-click" matters Traditional phishing needs the victim to do something. Click a link. Open an attachment. Enter a password. **Beehive removes that step entirely.** The NCSC advisory states that the user only has to _view_ a malicious email inside a vulnerable ZCS webmail session for the exploit to fire and for the attacker to obtain persistent access to that mailbox and, in many cases, wider network access. There is no visible warning to the person on the other side of the screen. This matters because most enterprise defences still assume the human is the last line. Security awareness training, hover-before-you-click, report-a-phish buttons, none of that helps when the payload runs on render. ## Who has been named The advisory has been co-sealed by NCSC (UK) alongside agencies from Australia, Canada, the Czech Republic, Denmark, Estonia, Finland, France, Italy, Moldova, Poland, Spain, Sweden, the Netherlands, New Zealand and the United States. It is available in full on the US Department of Defense media library as _Russian state-supported cyber actors conduct phishing campaign targeting users of Zimbra Collaboration Suite_. ## What UK officials are saying > "Today's action shows we're working hand-in-hand with our allies to expose Russian state-supported hackers targeting Western organisations. It is particularly concerning that these thugs tested their methods on victims in Ukraine, before targeting members of NATO. Organisations across the UK should sign up to NCSC's Early Warning service to ensure they can quickly secure their systems against similar activity." > > **Dan Jarvis MBE, Security Minister** > "This phishing campaign demonstrates how hostile actors will ruthlessly adapt techniques and exploit vulnerable technology in pursuit of their aims to steal sensitive information from Western organisations. With our international partners, we strongly encourage organisations to familiarise themselves with the zero-click techniques described in the advisory, which could be used against other platforms, and act on the mitigation advice." > > **Beth Hopkins CMG, NCSC Chief Operating Officer** ## The AI angle Technical analysis referenced in the advisory indicates that Artificial Intelligence played a role in generating parts of the codebase used in the operation. The Five Eyes agencies published a separate note earlier this month warning that AI is accelerating the speed, scale and sophistication of state-backed cyber operations. Beehive is a live example of what that looks like in practice: a small, cheap, machine-generated payload delivered against a widely deployed enterprise mail product. ## The wider pattern Beehive is not an isolated incident. It sits alongside a run of 2025 and 2026 attribution notices from NCSC and partners covering GRU Unit 26165 targeting logistics and technology firms, prolonged access campaigns against network edge devices, and repeated abuse of legitimate services for credential theft. The agencies caution that beehive is very likely to be adapted to exploit other email platforms once organisations start patching Zimbra. ## What organisations should do now - **Patch Zimbra Collaboration Suite immediately** to the versions specified in the joint advisory and confirm the patch level from the console, not from ticketing systems. - **Assume compromise for exposed instances** that have been internet-facing without the patch since July 2025. Rotate mailbox credentials, review OAuth tokens and application passwords, and check for unauthorised mail forwarding rules. - **Improve email-plane monitoring.** Look for anomalous IMAP, EWS or Zimbra API access, especially from residential proxies and cloud egress ranges. - **Sign up to the free [NCSC Early Warning service](https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning)** for automatic notification of malicious activity on your networks. - **Segregate the crown jewels.** Where email is the exfiltration path, the sensitive assets attached to it, board packs, M&A drafts, legal privileged material, HR files, should not live in the same always-on system. ## The Firevault view Zero-click is a category shift. It ends the assumption that a well-trained user is enough. It also ends the assumption that "cloud email = safe email", because the vulnerability is in the render path, not in the user's behaviour. The right response is not more training. It is **less exposure**. [Offline Secure Storage](/offline-secure-storage) is designed for exactly this problem. Sensitive material, the specific files an attacker would go for once they are inside a mailbox, sits on a self-controlled, air-gapped vault that is physically disconnected outside a scheduled access window. There is no render path to exploit, no persistent session for an attacker to hijack, no OAuth token to steal. Combined with the [Control Blueprints](/control), it gives boards a defensible answer to the question regulators are now asking: _where do you keep the material you cannot afford to lose, and what happens if the always-on estate is compromised tomorrow morning?_ Beehive will not be the last zero-click. It is the first widely attributed one against enterprise mail. Every organisation that treats email as the vault should read the advisory in full, patch on the same day, and then have an honest conversation about which of its data ever needed to be on an always-on system in the first place. ## Sources - NCSC, "UK and partners expose Russian state-supported actors for new zero-click phishing campaign targeting Western organisations", 23 July 2026 ([ncsc.gov.uk](https://www.ncsc.gov.uk/news/uk-and-partners-expose-russian-state-supported-actors-for-new-zero-click-phishing-campaign)). - Joint Cybersecurity Advisory, "Russian state-supported cyber actors conduct phishing campaign targeting users of Zimbra Collaboration Suite", 22 July 2026 ([media.defense.gov](https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF)). - NCSC, "The AI shift in cyber risk: why leaders must act now", 2026 ([ncsc.gov.uk](https://www.ncsc.gov.uk/news/the-ai-shift-in-cyber-risk-why-leaders-must-act-now)). Sources ## Where this reporting comes from 01 **Original report**Primary coverage referenced in this analysis [View original article](https://www.ncsc.gov.uk/news/uk-and-partners-expose-russian-state-supported-actors-for-new-zero-click-phishing-campaign) About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. [Get started](/get-started)[Talk to the team](/demo) **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful [ ![AnMed Closes Facilities Following Ransomware Attack and Data Claims](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/anmed-facility-closures-following-ransomware-cyberattack-1786723492583.png) Breach Analysis ### AnMed Closes Facilities Following Ransomware Attack and Data Claims South Carolina health system AnMed was forced to close 83 facilities following a cyberattack. Threat actors subsequently claimed to hold 6 terabytes of sensitive patient records. 14 Aug 2026 4 min ](/news/anmed-facility-closures-following-ransomware-cyberattack)[ ![US directive allows private firms to conduct offensive cyber operations](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/us-directive-private-firms-offensive-cyber-operations-1786723418300.png) Breach Analysis ### US directive allows private firms to conduct offensive cyber operations US President Donald Trump has signed a memorandum permitting private firms to execute offensive cyber operations. The move raises new risks of retaliatory attacks and collateral system disruptions. 14 Aug 2026 3 min ](/news/us-directive-private-firms-offensive-cyber-operations)[ ![Adobe Commerce attacked immediately after session breach vulnerability](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/adobe-commerce-session-vulnerability-exploited-after-disclosure-1786684691416.png) Breach Analysis ### Adobe Commerce attacked immediately after session breach vulnerability Security firm Sansec blocked attacks targeting Adobe Commerce immediately after disclosure. The flaw allows unauthenticated attackers to hijack sessions and customer data. 14 Aug 2026 4 min ](/news/adobe-commerce-session-vulnerability-exploited-after-disclosure)[ ![Cornelius faces legal investigation after alleged Cl0p cyber attack](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/cornelius-alleged-clop-ransomware-data-breach-1786684482605.png) Breach Analysis ### Cornelius faces legal investigation after alleged Cl0p cyber attack Cornelius faces legal scrutiny following reports of a Cl0p ransomware breach in August 2026. Claims suggest thousands of gigabytes of corporate data were compromised. 14 Aug 2026 4 min ](/news/cornelius-alleged-clop-ransomware-data-breach)[ ![Rogue Wi-Fi at 35,000 Feet: What the Delta Flight 591 Incident Teaches About Network Trust](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fdelta-rogue-wifi-defcon-2026.jpg) Breach Analysis ### Rogue Wi-Fi at 35,000 Feet: What the Delta Flight 591 Incident Teaches About Network Trust Delta Air Lines is investigating an unauthorised Wi-Fi network broadcast aboard Flight 591 from Las Vegas to Atlanta, alongside a deauthentication attack that knocked passengers off the aircraft network. The lesson is not about aviation. It is about how easily a trusted connection can be impersonated. 13 Aug 2026 4 min ](/news/delta-flight-rogue-wifi-deauth-attack-def-con-2026)[ ![Ransomware Attacks Spike 20% in July While AI Steals the Headlines](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fransomware-spike-ai-distraction.jpg) Breach Analysis ### Ransomware Attacks Spike 20% in July While AI Steals the Headlines Ransomware attacks jumped nearly 20 per cent in July, with 799 incidents logged globally. While AI dominates security headlines, finance, technology, pharmaceutical, medical billing and education organisations absorbed the sharpest increases. 12 Aug 2026 4 min ](/news/ransomware-attacks-spike-july-2026-ai-distraction) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/how-it-works/offline-secure-storage) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)