Response to CISA Advisory (AA26-204A): Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

CISA and partners published a joint advisory describing Laundry Bear (a Russian state‑supported actor) exploiting a Zimbra zero‑day (CVE-2025-66376) since at least July 2025 to silently exfiltrate up to 90 days of email, GAL entries, and other sensitive data; AttackIQ provides emulation scenarios and CISA mitigation guidance emphasizing immediate patching, monitoring of network/exfiltration indicators, and authentication hardening.