Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries

Russian state-sponsored group Laundry Bear exploited a zero-day vulnerability in Zimbra Collaboration Suite for five months before patching in November 2025, stealing email, credentials, and authentication tokens from governments and organisations across defence, energy, finance and technology sectors. The group continues active exploitation of unpatched instances.

This Wire brief sits within Fusion42's coverage of Cybersecurity. Wire is Fusion42's founder-focused intelligence feed: each story is connected to the funds and startups it names — every one with a live profile on Raise or Scout — so founders can follow the capital and the momentum behind the headline rather than just the headline itself. Wire analysis is one of the live surfaces Arthur reasons over.