UK and partners expose Russian state-supported actors for new ‘zero-click’ phishing campaign targeting Western organisations
- Russian state-supported actors develop new technique to target Western email platforms and gain persistent access to compromised networks.
- Organisations provided with trusted advice and support to protect sensitive data in the face of evolving cyber threats.
Russian state-supported cyber actors have targeted Western organisations with a malicious campaign which uses a zero-click exploit coined “beehive” (or “Ulej”) to steal emails, the UK has warned.
Today, the National Cyber Security Centre – a part of GCHQ – alongside cyber security agencies in 15 countries, has exposed the activities of LAUNDRY BEAR, an advanced persistent threat group that specialises in the covert acquisition of email data.
Since July 2025, LAUNDRY BEAR has successfully targeted and stolen sensitive email information from organisations that use Zimbra Collaboration Suite (ZCS) software. US organisations have been targeted in sectors including defence, government, education, energy, law enforcement, media, NGOs, and technology.
In a new joint advisory, the NCSC and partners warn LAUNDRY BEAR’s ongoing campaign is indicative of espionage and almost certainly carried out with Russian state support.
Unlike traditional phishing campaigns, “beehive” allows the threat actors to gain extensive and sustained access to emails without requiring user input. Instead of clicking a link or opening a file, the user only has to view a malicious email within a vulnerable version of the ZCS webmail service to be compromised.
Organisations that use ZCS are urged to follow the mitigation advice, including to immediately patch vulnerabilities and improve network monitoring capabilities.
The cyber agencies caution that it is likely “beehive” could be adapted to exploit other vulnerabilities. As more organisations update their ZCS software, it is very likely that the group will also look to target other email systems used by Western organisations.
The NCSC recommends all UK organisations sign up for the free Early Warning service for notifications of malicious network activity.
The government is committed to raising cyber resilience across the UK to protect businesses and safeguard growth. Earlier this month, businesses from every corner of the British economy joined a pledge publicly committing to strengthen their defences in the face of a fast-evolving threat.
Today’s action shows we’re working hand-in-hand with our allies to expose Russian state-supported hackers targeting Western organisations. It’s particularly concerning that these thugs tested their methods on victims in Ukraine before targeting members of NATO.
Organisations across the UK should sign up for NCSC’s Early Warning service to ensure they can quickly secure their systems against similar activity.
This phishing campaign demonstrates how hostile actors will ruthlessly adapt techniques and exploit vulnerable technology in pursuit of their aims to steal sensitive information from Western organisations.
With our international partners, we strongly encourage organisations to familiarise themselves with the ‘zero-click’ techniques described in the advisory which could be used against other platforms, and act on the mitigation advice.
We will continue to call out malicious cyber activity supported by the Russian state and urge everyone to follow NCSC guidance to raise resilience, including steps to strengthen online account security.
The advisory highlights how these malicious cyber techniques were extensively trialled on Ukrainian victims before use against members of NATO, which is part of a growing trend among Russian cyber threat groups.
In this case, technical analysis indicates that Artificial Intelligence (AI) played a role in the development of a simple codebase for the operation. Recently, the Five Eyes cyber security agencies called on leaders to take key actions as AI continues to accelerate the speed, scale, and sophistication of cyber threats.
The NCSC has co-sealed this new advisory alongside agencies from Australia, Canada, the Czech Republic, Denmark, Estonia, Finland, France, Italy, Moldova, Poland, Spain, Sweden, the Netherlands, New Zealand, and the United States.
It can be read on the NSA website: https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF
Source: UK NCSC (Cyber) (23 July 2026)
