{"id":31100,"date":"2026-08-31T07:00:00","date_gmt":"2026-08-31T05:00:00","guid":{"rendered":"https:\/\/smecyberinsights.co.uk\/?p=31100"},"modified":"2026-09-01T14:26:56","modified_gmt":"2026-09-01T12:26:56","slug":"ncsc-russian-zero-click-phishing-western-organisations","status":"publish","type":"post","link":"https:\/\/smecyberinsights.co.uk\/index.php\/2026\/08\/31\/ncsc-russian-zero-click-phishing-western-organisations\/","title":{"rendered":"NCSC UK & Allies Expose Russian State-Supported Zero-Click Phishing Campaign"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\"Partners1_NordVPN\"<\/figure><\/div>
\"Partners3_R3\"<\/figure><\/div>
\"Partners2_Zoho\"<\/figure><\/div>
\"Partners4_Plesk\"<\/figure><\/div>
\"Red_Button_Slider\"<\/figure><\/div>
\"ogo2\"<\/figure><\/div>
\"Securus<\/figure><\/div>\t\t\t<\/div>\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"NCSC\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
Image Credit: Designed by Magnific<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"Nord\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"nordvpn-internet-security-privacy\"\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

Helping Keep Small Business CYBERSafe!
\n<\/strong>Gibraltar: Monday 31 August 2026 at 07:00 CET<\/p>\n

NCSC UK and Allies Expose Russian State-Supported Zero-Click Phishing Campaign Targeting Western Organisations
\n<\/strong>Published in Collaboration with: Nord VPN
\n<\/a>By\u00a0Iain Fraser<\/a>\u00a0\u2013\u00a0Cybersecurity Journalist & Authority Writer<\/a>
\nVia SME Cyber Insights \u2013\u00a0First for SME Cybersecurity News<\/a>
\nGoogle Indexed on: 310826 at 09:45 CET | SERPS: LLM<\/a>(AI) Google<\/a>
\n#CyberJourno #CyberEssentials #CyberResilience #CyberSafe #CyberSecurity <\/u><\/u><\/em>#Cybersecurity #NCSC #SME #SMECyberInsights #SMECybersecurity #SMECyberInsights <\/u><\/u><\/em>#ThreatIntelligence StateActors #Russia<\/em><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

NCSC UK and Allies Expose Russian State-Supported Zero-Click Phishing Campaign Targeting Western Organisations <\/strong><\/p>\n

The latest warning from the UK\u2019s National Cyber Security Centre is a reminder that phishing no longer needs a clumsy link, a dubious attachment, or an especially unlucky click. In this case, the concern is a zero-click<\/strong> campaign tied to Russian state-supported actors, where simply viewing a malicious email in a vulnerable system may be enough to trigger compromise. That makes the threat both technically serious and operationally awkward, particularly for organisations still treating phishing as a user-awareness problem alone.<\/p>\n

What the NCSC and partners have exposed<\/strong><\/p>\n

The NCSC, working with cyber agencies in 15 countries, has exposed activity linked to LAUNDRY BEAR<\/strong>, an advanced persistent threat group focused on stealing email data.<\/p>\n

According to the NCSC, the group has targeted organisations using Zimbra Collaboration Suite<\/strong> since July 2025. Sectors affected in the US have included:<\/p>\n

* defence
\n* government
\n* education
\n* energy
\n* law enforcement
\n* media
\n* NGOs
\n* technology<\/p>\n

The campaign uses a zero-click exploit known as \u201cbeehive\u201d<\/strong> or \u201cUlej\u201d<\/strong>. The NCSC says that, unlike traditional phishing, the victim does not need to click a link or open a file. Instead, \u201cthe user only has to view a malicious email within a vulnerable version of the ZCS webmail service to be compromised.\u201d<\/strong><\/p>\n

That small detail changes the defensive picture considerably.<\/p>\n

Why this campaign matters<\/strong><\/p>\n

Most phishing guidance still centres on user behaviour: do not click, do not download, do not trust odd messages. That advice still matters, but this campaign shows its limits.<\/p>\n

Zero-click means less room for human recovery<\/strong><\/p>\n

If compromise can happen when an email is merely viewed in a vulnerable platform, then the attack path depends less on user error and more on:<\/p>\n

* software patching
\n* exposure management
\n* threat detection
\n* monitoring for persistence
\n* platform-specific hardening<\/p>\n

That is why this campaign should be read as an infrastructure warning as much as an espionage warning.<\/p>\n

Email remains a strategic target<\/strong><\/p>\n

The NCSC says LAUNDRY BEAR specialises in the \u201ccovert acquisition of email data\u201d<\/strong>. That matters because email is still one of the richest targets in any organisation. A compromised mailbox can reveal:<\/p>\n

* internal discussions
\n* credentials and reset flows
\n* attachments and sensitive documents
\n* contact networks
\n* security conversations
\n* commercial and diplomatic context<\/p>\n

In the wrong hands, a mailbox is less a message archive than a guided tour of the organisation.<\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"NCSC\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

What organisations should do now<\/strong><\/p>\n

The NCSC says organisations using Zimbra should immediately patch vulnerabilities<\/strong> and improve network monitoring capabilities<\/strong>. That is the urgent response.<\/p>\n

The broader message is that defenders should assume similar techniques may spread. The NCSC and partners warn it is likely \u201cbeehive\u201d could be adapted to exploit other vulnerabilities\u201d<\/strong> and that as organisations update Zimbra, the group may shift to other email systems used by Western organisations.<\/p>\n

In practice, that means organisations should prioritise:<\/p>\n

* patching internet-facing email systems quickly
\n* reviewing exposure in Zimbra and comparable platforms
\n* strengthening detection for unusual email access and persistence
\n* monitoring for post-compromise behaviour
\n* improving resilience around account and session security<\/p>\n

The NCSC also recommends that UK organisations sign up for its free Early Warning<\/strong> service for malicious network activity notifications.<\/p>\n

FAQs<\/strong><\/p>\n

FAQs note:<\/strong> These FAQs are derived from recurring live audience questions and discussion themes on Reddit and Quora relevant to phishing, email security, state-backed cyber activity, and zero-click exploits. They are not generated from the article body.<\/p>\n

1. What does zero-click phishing mean?<\/strong><\/p>\n

It means the victim does not need to click a malicious link or open an attachment. In this case, simply viewing a malicious email in a vulnerable email platform may be enough for compromise.<\/p>\n

2. Is this only a problem for Zimbra users?<\/strong><\/p>\n

Zimbra users are the immediate focus of this warning, but the advisory suggests similar methods could be adapted for other platforms if attackers find suitable vulnerabilities.<\/p>\n

3. Why are email systems such valuable targets?<\/strong><\/p>\n

Because email often contains sensitive information, reset links, internal discussions, attachments, and access clues that can support espionage, fraud, and wider compromise.<\/p>\n

4. Can staff awareness training stop this kind of attack?<\/strong><\/p>\n

Not on its own. Awareness still matters, but zero-click attacks rely more heavily on patching, technical controls, platform security, and detection capability.<\/p>\n

Looking Forward<\/strong><\/p>\n

This campaign is a useful corrective to a common cybersecurity habit: assuming phishing is mainly about persuading users to make mistakes. Increasingly, the more serious campaigns are designed to remove the user from the equation wherever possible.<\/p>\n

For Western organisations, the lesson is straightforward. If email remains central to operations, then email infrastructure must be treated as a frontline security system, not a background utility. In a zero-click world, the old advice to \u201cbe careful what you click\u201d is still true. It is just no longer enough.<\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tNCSC Advisory<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"SME\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
Image Credit: IfOnlyCommunications<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

ABOUT IAIN FRASER \u2013<\/strong> I am a Gibraltar based, Accredited Journalist, (*NUJ, IFJ & ONA) Authority Writer,\u00a0 Commentator & Publisher of SMECyber<\/strong><\/a> and cover all aspects of Cybersecurity<\/strong> [Awareness, Threat Management, Best Practice Compliance & Mitigation] and report throughout Europe & the UK<\/p>\n

LinkedIn Bio: IainFraserJournalist<\/a>
\nEmail: iain@iainfraser.net<\/a> | www.iainfraser.net<\/a><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tHIRE ME! \/...<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"CYBERInsights\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
Image Credit: IfOnlyCommunications<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

UK Small Business Owner? Join SMECyber Free Now! & Access the SME Cyber Forum – Read, Learn, Engage, Share …<\/h4>\n

The Latest SME<\/strong> Cybersecurity News, Threat Intelligence & Analysis, Timely Scam Alerts, Best-practice Compliance, Mitigation & Resources specifically curated for UK Based SMEs<\/strong> in a Single Weekly Email direct to your Inbox or Smart Device together with Unrestricted Free Access to our entire SME<\/strong> Cyber Knowledge & Tutorial Library.<\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tLearn More \/...<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"Nord_logo_1.png\"\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

What is a VPN & Does my SME Need one?<\/strong> A VPN<\/strong><\/a> is a Virtual Private Network a method of securing your communications credentials. When it comes to SMEs<\/strong><\/a>, the choice of VPNs<\/strong><\/a> can significantly impact the security and efficiency of their operations. NordVPN<\/b> secures your Internet data with military-grade encryption, ensures your activity remains private and helps bypass geographic content restrictions online.\u00a0 \u00a0Join\u00a0NordVPN\u00a0Today and\u00a0Save\u00a0up to\u00a073%\u00a0and Get 3 months\u00a0Extra Free<\/a> – Rude Not to \u2026!<\/strong><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tLearn More \/...<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"Data<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t<\/div>\n\t\t\t\t\t
\n\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Image Credit: Designed by Magnific NCSC Advisory Image Credit: IfOnlyCommunications HIRE ME! \/… Image Credit:…<\/p>\n","protected":false},"author":1,"featured_media":31101,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"cybocfi_hide_featured_image":"yes","footnotes":""},"categories":[710],"tags":[945],"ppma_author":[505],"class_list":["post-31100","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ncsc","tag-ncsc-advisory"],"featured_image_urls":{"full":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2026\/08\/Zero-Click-Phishing.jpg",1379,919,false],"thumbnail":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2026\/08\/Zero-Click-Phishing-150x150.jpg",150,150,true],"medium":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2026\/08\/Zero-Click-Phishing-300x200.jpg",300,200,true],"medium_large":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2026\/08\/Zero-Click-Phishing-768x512.jpg",640,427,true],"large":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2026\/08\/Zero-Click-Phishing-1024x682.jpg",640,426,true],"1536x1536":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2026\/08\/Zero-Click-Phishing.jpg",1379,919,false],"2048x2048":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2026\/08\/Zero-Click-Phishing.jpg",1379,919,false],"covernews-featured":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2026\/08\/Zero-Click-Phishing-1024x682.jpg",1024,682,true],"covernews-medium":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2026\/08\/Zero-Click-Phishing-540x340.jpg",540,340,true]},"author_info":{"display_name":"Cybersecurity Journalist Iain Fraser","author_link":false},"category_info":"NCSC<\/a>","tag_info":"NCSC","comment_count":"0","authors":[{"term_id":505,"user_id":1,"is_guest":0,"slug":"admin_yjdstq4n","display_name":"Cybersecurity Journalist Iain Fraser","avatar_url":{"url":"https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2024\/10\/index_image440-removebg-preview.png","url2x":"https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2024\/10\/index_image440-removebg-preview.png"},"author_category":"1","user_url":"http:\/\/smecyberinsights.co.uk","last_name":"Cybersecurity Journalist","first_name":"Iain Fraser","job_title":"","description":""}],"_links":{"self":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/31100","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=31100"}],"version-history":[{"count":9,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/31100\/revisions"}],"predecessor-version":[{"id":31278,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/31100\/revisions\/31278"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/media\/31101"}],"wp:attachment":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=31100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=31100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=31100"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/ppma_author?post=31100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}