Wire · regulatory

CISA, NSA, FBI and Partners Warn Zimbra Collaboration Suite Users of Ongoing Russian ...

23 July 2026 · By Derek Watson · Wire by Fusion42

Published

23 July 2026

Topic

regulatory

◆ Sectors

Cybersecurity

◆ Geography

United States

◆ Source

Read at cisa.gov →

◆ Verified

Fusion42 · 23 July 2026 · Fusion42 review

Russian state-backed APT group LAUNDRY BEAR is conducting a zero-click phishing campaign against Zimbra Collaboration Suite users across Western government and commercial organisations, exploiting CVE-2025-66376 to exfiltrate email credentials and 2FA tokens. CISA, NSA, FBI and international partners have published mitigations and remediation guidance for organisations using ZCS webmail.

This Wire brief sits within Fusion42's coverage of Cybersecurity, and 2 sources have reported it.

◆ ◆ The Wire takeaway

If you sell email security, backup, or identity verification to government or defence contractors, your customers are being actively hunted right now and will buy hardening. If you run Zimbra, patch CVE-2025-66376 this week—LAUNDRY BEAR's toolkit works without user interaction.

◆ Coverage

2 sources · 23 Jul 2026

◆ Related on Wire

◆ Topics

Cybersecurityzero-day-exploitemail-securitynation-state-threatcritical-infrastructurecredential-theft