Russia-backed Laundry Bear cyber espionage

In late July 2026, Western intelligence agencies warned that the Russian‑linked hacking group “Laundry Bear” was conducting a broad cyber‑espionage campaign against government and commercial networks in Ukraine, the United States and other NATO members. The group exploited a vulnerability in Zimbra email software to harvest sensitive communications. On the same day, the European Union adopted its 21st sanctions package against Russia, targeting vessels, individuals, entities and crypto platforms linked to the Kremlin’s shadow‑fleet.

Three days later, Finnish authorities issued a public alert about the continued activity of Laundry Bear, noting that the group was still targeting email systems in public administration, critical infrastructure and defence sectors despite the recent software patch. The warning emphasized the need for updated security measures. In Italy, a Milan court convicted two entrepreneurs of collaborating with Russian intelligence, sentencing them for providing surveillance‑related services to Russian agents in exchange for cryptocurrency. These legal actions illustrate a widening response to the same espionage network, extending from diplomatic sanctions to national security alerts and criminal prosecutions.

Together, the snapshots show an escalating pattern of Russian cyber operations and the corresponding multi‑layered Western counter‑measures across diplomatic, security and judicial domains.