Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

CISA advisories describe ongoing state-sponsored and aligned cyber activity targeting collaboration platforms, networking infrastructure, operational technology, and critical infrastructure. Russian actors exploit Zimbra Collaboration Suite CVE-2025-66376 for covert email collection and compromise vulnerable or poorly configured routers. China-nexus actors compromise network devices to build covert proxy infrastructure and enable espionage. Iranian-affiliated actors target internet-exposed PLCs and manipulate industrial control systems, while pro-Russia hacktivists conduct opportunistic OT/ICS