NSA and Partners Warn of Russian State-Supported Phishing Campaign Targeting Zimbra Collaboration Suite

The National Security Agency (NSA), in collaboration with CISA, FBI, and other partners, has released a Cybersecurity Advisory detailing a Russian state-supported phishing campaign. The campaign, attributed to the group LAUNDRY BEAR, has been targeting users of Zimbra Collaboration Suite (ZCS) across U.S. and allied government and commercial networks since July 2025. The actors exploit a zero-day vulnerability (CVE-2025-66376) to exfiltrate email directories and sensitive information. The advisory provides indicators of compromise and mitigation steps.

Context

The advisory focuses on a phishing campaign linked to the group LAUNDRY BEAR, which has been active since July 2025. The attackers are exploiting a recently discovered vulnerability in the Zimbra Collaboration Suite, allowing them to access and extract sensitive information. This type of cyber activity reflects ongoing geopolitical tensions and the increasing sophistication of cyber threats.

Why it matters

The warning from the NSA and its partners highlights a significant cybersecurity threat posed by state-sponsored actors. This campaign targets critical communication tools used by government and commercial entities, which could lead to the compromise of sensitive information. Understanding and mitigating these threats is crucial for national security and the protection of private data.

Implications

If left unaddressed, this phishing campaign could lead to widespread data breaches, affecting government operations and private sector entities alike. Organizations may face reputational damage and financial losses as a result of compromised data. Increased scrutiny on cybersecurity measures is likely, prompting businesses and agencies to enhance their defenses against similar threats.

What to watch

Organizations using the Zimbra Collaboration Suite should prioritize implementing the recommended mitigation steps outlined in the advisory. Observers should monitor for updates on the zero-day vulnerability and any new tactics employed by the attackers. Additionally, further advisories from cybersecurity agencies may emerge as the situation develops.