Loading threat actor…
Void Blizzard, also tracked as LAUNDRY BEAR and CL-STA-1114, is a Russophone cyberespionage threat actor assessed to be aligned with Russian state interests. The actor has conducted espionage operations against government, defense, transportation, and financial organizations, with targeting spanning NATO member states, Ukraine, other CIS countries, and parts of Africa. Reported activity has been ongoing since at least 2024, with Zimbra-focused operations observed from July 2025. A prominent operation attributed with medium confidence to this actor is Operation GhostMail, which involved exploitation of CVE-2025-66376, a stored cross-site scripting vulnerability in Synacor Zimbra Collaboration Suite Classic UI. The actor used crafted phishing emails, including HTML content embedded in messages or attachments, to trigger JavaScript execution in vulnerable webmail sessions, in some cases characterized as zero-click exploitation. Observed payload behavior included theft of web session material, credentials, browser-saved passwords, two-factor authentication scratch codes, mailbox contents, search history, and directory data. The activity also established persistence by creating app-specific passwords that could survive password resets and enable continued mail access without normal two-factor prompts. Tradecraft associated with CL-STA-1114 includes spearphishing, exploitation of public-facing applications, JavaScript-based payload execution, obfuscation and decoding of malicious content, command-and-control-based exfiltration, credential theft, session hijacking, email collection, and persistence through abuse of legitimate mail platform features. The actor has also been linked to abuse of CVE-2025-66376 more broadly in campaigns targeting Western governments and organizations in Ukraine. The overall pattern is consistent with intelligence collection rather than financially motivated intrusion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
53 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
A TTP Instance detailed CL-STA-1114's abuse of CVE-2025-66376.
The activity, which began on July 22, 2026, involves the weaponization of CVE-2026-42897 (CVSS score: 8.1), a cross-site scripting (XSS) vulnerability in OWA. It was flagged by Microsoft as having been exploited in attacks as far back as May 2026.
54 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Abused CVE-2025-66376 as part of its intrusion activity.
Attributed Russian threat cluster involved in targeted exploitation of Zimbra CVE-2025-66376 against Western and Ukrainian organizations for mailbox compromise and espionage.
Cyberespionage campaign targeting Zimbra webmail users in government, defense, transport, and finance sectors using zero-click phishing emails that exploit Zimbra Collaboration Suite to steal credentials, session data, and email contents.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.