Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

CISA advisories describe state-sponsored and hacktivist campaigns targeting collaboration platforms, networking infrastructure, global routers, critical infrastructure OT/ICS, and government organizations. Key activity includes Russian exploitation of Zimbra Collaboration Suite CVE-2025-66376, Russian FSB targeting of vulnerable networking devices, PRC-linked compromise and persistence on routers to support espionage, Iranian-affiliated manipulation of internet-exposed PLCs, and opportunistic pro-Russia attacks against OT and critical infrastructure. Defenders should prioritize patching known/