Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

CISA advisories report active state-sponsored and hacktivist cyber operations targeting collaboration platforms, networking infrastructure, telecommunications, critical infrastructure, operational technology, and government organizations. Key activity includes Russian actors exploiting Zimbra Collaboration Suite vulnerability CVE-2025-66376 for email theft, Russian FSB actors compromising poorly configured network devices, Chinese actors maintaining persistence in routers and using compromised infrastructure for espionage, Iranian-affiliated actors disrupting internet-exposed PLCs, and pro-R俄s