LAUNDRY BEAR

Laundry Bear is a Russia-aligned cyberespionage threat actor also tracked as Void Blizzard, TA488, and UAC-0190, with additional reporting linking it to CL-STA-1114 and the former designation UNK_PitStop. The group is assessed to operate on behalf of Russian state interests and has been described as state-supported, with reporting and legal action tying elements of its activity to Russian individuals and infrastructure associated with Russian intelligence-linked entities. The actor is primarily focused on intelligence collection against Western and Ukrainian targets. Reported targeting includes NATO member states, Ukraine, the United States, and European organizations. Victim sectors include government, defense, education, telecommunications, financial services, hospitality, aerospace, energy, media, law enforcement, technology, and other commercial organizations. A recurring operational objective is covert access to email systems and long-term collection of mailbox contents, directories, credentials, tokens, and related sensitive communications data. Laundry Bear is notable for repeated exploitation of webmail platforms using "half-click" or view-based attacks in which opening or previewing a malicious email is sufficient to trigger code execution in the victim's authenticated browser session. In campaigns against Zimbra Collaboration Suite, the group exploited CVE-2025-66376 to deliver the JavaScript payload known as ZimReaper, which harvested recent email content, credentials, CSRF material, two-factor authentication data, and application passwords, while also enumerating address lists and maintaining persistent mail access. In later operations against on-premises Microsoft Exchange Outlook Web Access, the group exploited CVE-2026-42897 to deploy OWAReaper, a browser-resident implant that executes entirely within the OWA reading pane. OWAReaper demonstrates unusually mature tradecraft for browser-based mailbox compromise. It collects mailbox and configuration data, attempts credential theft through browser autofill abuse, steals OAuth tokens via permissive Outlook add-ins, rewrites malicious messages to remove exploit content after execution, and establishes persistence through multiple layers. These include encrypted storage in browser state, poisoning of offline cached messages, and server-side mailbox permission abuse that can preserve access even after password changes or device reimaging. The malware also supports covert command-and-control through public code-hosting commit messages and attacker-sent emails, and exfiltrates stolen data over encrypted web channels with DNS-based fallback. Beyond exploit-driven mailbox compromise, Laundry Bear has also been associated with credential phishing, spoofed login pages, password spraying, and session-token replay against cloud email environments, especially Office 365. Reported operations used geographically proximate proxy infrastructure to evade geo-blocking and were frequently followed by data exfiltration. The group has therefore demonstrated both credential-theft and session-hijacking tradecraft, alongside broader post-compromise mailbox abuse and persistence. Overall, Laundry Bear is a Russian cyberespionage actor specializing in email-centric intrusion operations, combining phishing, token abuse, stealthy browser implants, and exploitation of webmail vulnerabilities to obtain durable access to high-value communications for intelligence collection.