Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite ↗

Russian state-supported actors are exploiting a zero-day in Zimbra Collaboration Suite to steal email data via phishing.

Russian state-supported cyber actors, known as LAUNDRY BEAR, have been targeting Western organizations using the Zimbra Collaboration Suite since at least July 2025. They are exploiting a zero-day vulnerability (CVE-2025-66376) to covertly acquire email data, demonstrating their continued use of phishing and novel exploits.

▸ DO  Patch Zimbra Collaboration Suite immediately and hunt for compromised email accounts.