A group of Russian hackers conducted a large-scale cyber-espionage campaign over the past year, targeting nuclear scientists, employees of defence contractors, and government officials in the United States. This was reported by CNN on July 23, 2026, citing data from private-sector researchers and a joint warning from U.S. intelligence and security agencies along with more than a dozen allied countries.
According to the cybersecurity firm Proof splint, the hackers (tracked as TA488, also known as Laundry Bear / Void Blizzard) attacked Zimbra-based email servers used by “nuclear installations and the defence industrial base” in the U.S. The attackers showed particular interest in specialists and organizations connected to nuclear fusion — likely to assess the progress made by Western countries in this field.
The attackers exploited a rare vulnerability (the so-called “half-click exploit”) in Zimbra software. Success required only that the victim open the email — no clicking on links or attachments was necessary. This allowed them to steal three months of the victim’s email correspondence as well as the entire corporate email directory. The vulnerability was patched by the vendor in November 2025, but it had been exploited for at least five months prior to the fix.
The campaign was first tested against Ukrainian targets, after which the same methods were applied against organizations in NATO countries, including the United States. Affected sectors included federal and local government bodies, law enforcement agencies, as well as the defence, education, and energy industries.
In the joint warning issued by U.S. and allied intelligence services, it is noted that the group likely sought to obtain strategic information about Western military plans, logistics, and policy decisions. UK Security Minister Dan Jarvis stated that it is particularly concerning that the methods were first tested on Ukraine and then directed against NATO members.