Threat Actor
Laundry Bear
Properties
- summary
- Used a zero-click/half-click phishing technique exploiting a Zimbra zero-day to steal mail and 2FA codes from Western mailboxes.
- first_seen
- 2026-07-27T04:00:26.959997+00:00
- last_seen
- 2026-07-27T04:00:26.959997+00:00
- created_at
- 2026-07-27T04:00:26.959997+00:00
- mention_count
- 1
- evidence_url
- https://therecord.media/zimbra-webmail-zero-click-phishing-russia-laundry-bear
- target
- Government/webmail users globally, US, Ukraine
- provenance
- news-scan
- suspected_origin
- Russia
- scan_confidence
- 0.92
- status
- pending
Explore this actor's full graph with Ninja Signal