Daily Briefing for 07.24.26

Top stories.

1. Russia's Laundry Bear targets unpatched Zimbra servers.
2. US State Department places visa restrictions on suspected cybercriminals.
3. Stadler Rail refuses to pay ransomware gang.

Russia's Laundry Bear targets unpatched Zimbra servers.

US intelligence agencies, alongside their Five Eyes allies and partners in Europe, yesterday issued an advisory warning of a Russian state-sponsored phishing campaign targeting Western government and commercial entities using vulnerable versions of the Zimbra Collaboration Suite (ZCS). The campaign is attributed to a threat actor tracked as "Laundry Bear" or "Void Blizzard," whose goal is to harvest sensitive email data on behalf of the Russian government.

The threat actor began exploiting a Zimbra vulnerability (CVE-2025-66376) as a zero-day last year. The flaw was patched in November 2025, but Laundry Bear continues to successfully breach organizations that have not applied the patch.

Proofpoint says the flaw enables "half-click exploits," in which a user only needs to open the email in order for the exploit code to execute. Palo Alto Networks' Unit 42 explains that the phishing emails contain a JavaScript payload that injects into the victim's browser and exfiltrates the user's email credentials, CSRF tokens, 2FA scratch codes, system and environment details, and the victim's last 90 days of email and search history.

US State Department places visa restrictions on suspected cybercriminals.

The US State Department has imposed visa restrictions on suspected cybercriminals and their immediate family members. Secretary of State Marco Rubio announced the restrictions on the final day of his visit to Southeast Asia, where industrial-scale scam centers have become a major regional concern. Rubio specifically called out online investment scams, which he says are "[o]ften orchestrated by Chinese transnational criminal organizations," as well as sextortion scams targeting American children.

The restrictions are imposed under Section 212(a)(3)(C) of the Immigration and Nationality Act.

Stadler Rail refuses to pay ransomware gang.

Swiss train manufacturer Stadler Rail says it refused to pay $12.3 million (₣10,000,000) ransom to an extortion gang that stole technical data from a vendor's file-sharing platform, the Record reports. The Everest ransomware gang claimed responsibility for the attack. Stadler said the stolen information is "not security-relevant," and the incident did not affect production or railway operations. The company added that it "will not pay any ransom under any circumstances and is therefore not susceptible to extortion."

Separately, Proofpoint published a report this week finding that more than one-third of companies that pay ransoms are later hit with a second ransom demand. TechCrunch notes that these findings "underscore the long-held understanding among security researchers and network defenders that it’s impossible to negotiate in good faith with an extortion racket because there’s no incentive for the other side to actually walk away."