A Zimbra phishing campaign attributed to Russian state-supported cyber actors has targeted Western government and commercial organizations, exploiting CVE-2025-66376 to access sensitive email data and other information, according to a joint cybersecurity advisory issued in July 2026.

The activity has been linked primarily to LAUNDRY BEAR, a Russian state-supported advanced persistent threat (APT) group tracked under several names across the cybersecurity industry. The advisory said the campaign has been active since at least July 2025 and has targeted organizations using the Zimbra Collaboration Suite (ZCS).

Unlike conventional phishing attacks that typically require victims to click a...