The United States and more than a dozen allied nations said that Russian hackers stole emails from users of the Zimbra email program without having to fool them into opening an attachment or clicking a link.
The trick, which cyber security firm Proofpoint described as a “half-click exploit,” leveraged a now-patched weakness in Zimbra software that allowed a hacker to compromise it after a user simply opened an email.
“No social engineering required,” Proofpoint said in a blog post outlining the hacking campaign.
In a 31-page alert about the hacking, police and intelligence agencies from the US, the Netherlands, Canada, Britain, Australia, New Zealand, Denmark, the Czech Republic and other European nations blamed what they said was a Russian government-supported hacking group Laundry Bear for the spy campaign.
They said the campaign heavily targeted Ukraine before hitting users in the US and other members of the NATO military alliance.
“It’s particularly concerning that these thugs tested their methods on victims in Ukraine, before targeting members of NATO,” British security minister Dan Jarvis said in a statement.
Laundry Bear is one of several hacking groups the US alleges are working for Russian security services.
A US indictment filed this month tied the group to a Russian cyber security company called Yutek-NN, whose deputy director, Denis Obrezko, faces hacking-related charges in Boston following his arrest in Thailand last year. He has pleaded not guilty.
The Russian embassy in Washington did not immediately respond to a request for comment. Yutek-NN has not responded to repeated requests for comment.
Moscow typically denies participating in hacking campaigns.
Zimbra and its owner, Buffalo, New York-based Synacor, could not be immediately reached for comment.
Like other digital intelligence gatherers, Russian cyber spies routinely target email services.
In April, Reuters reported Russian hackers had broken into scores of email accounts belonging to prosecutors and investigators across Ukraine.
