Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

CISA advisories report active state-sponsored and hacktivist cyber operations targeting Zimbra Collaboration Suite, exposed networking devices, compromised infrastructure, internet-facing PLCs and OT environments, and global telecommunications and government networks. Activity includes zero-day exploitation of CVE-2025-66376, phishing, password spraying, pass-the-cookie, router compromise and persistence, manipulation of PLC/SCADA systems, and opportunistic attacks against critical infrastructure. Advisories emphasize urgent patching, removing OT and network devices from direct internet access