NSA and Partners Warn of Russian State-Supported Phishing Campaign Targeting Government and Commercial Networks

The National Security Agency (NSA), in collaboration with partners, released a Cybersecurity Advisory (CSA) detailing a Russian state-supported phishing campaign. The threat group, known as LAUNDRY BEAR, has been targeting users of Zimbra Collaboration Suite (ZCS) across various U.S. and allied government and commercial networks since July 2025, leveraging a zero-day vulnerability to exfiltrate email directories and sensitive information. The advisory provides indicators of compromise and remediation steps.

Context

The NSA's advisory comes in response to a sustained phishing campaign attributed to LAUNDRY BEAR, a group linked to Russian state interests. Since July 2025, this group has exploited a zero-day vulnerability in the Zimbra Collaboration Suite, a widely used platform for email and collaboration. The advisory aims to inform organizations about the tactics used and provide guidance on mitigating risks.

Why it matters

This warning highlights the ongoing cybersecurity threats posed by state-sponsored actors, emphasizing the importance of vigilance among government and commercial entities. The targeted phishing campaign could lead to significant data breaches, affecting national security and business operations. Awareness of such threats is crucial for protecting sensitive information from unauthorized access.

Implications

If successful, this phishing campaign could lead to unauthorized access to sensitive government and commercial data, potentially impacting national security and business integrity. Affected organizations may face financial losses and reputational damage. The advisory serves as a reminder for all sectors to enhance their cybersecurity measures and prepare for potential threats.

What to watch

Organizations using the Zimbra Collaboration Suite should monitor their systems for signs of compromise as outlined in the advisory. The effectiveness of the recommended remediation steps will be critical in determining how well entities can defend against these attacks. Additionally, any updates from the NSA or cybersecurity experts regarding further developments in this campaign will be important.