--- title: Response to CISA Advisory (AA26-204A): Russian... description: CISA Advisory AA26-204A details how Russian state-sponsored threat actor Laundry Bear has been targeting government and commercial organizations in Western... canonical: https://daily.dev/posts/response-to-cisa-advisory-aa26-204a-russian-state-supported-cyber-actors-conduct-phishing-campaig-movbsbws5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Response to CISA Advisory (AA26-204A): Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite | daily.dev og:description: CISA Advisory AA26-204A details how Russian state-sponsored threat actor Laundry Bear has been targeting government and commercial organizations in Western... og:url: https://daily.dev/posts/response-to-cisa-advisory-aa26-204a-russian-state-supported-cyber-actors-conduct-phishing-campaig-movbsbws5 og:image: https://api.daily.dev/og/posts/MovBsbwS5.png og:image:alt: Response to CISA Advisory (AA26-204A): Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Response to CISA Advisory (AA26-204A): Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 6 min read · 0 upvotes · 0 comments ## Summary CISA Advisory AA26-204A details how Russian state-sponsored threat actor Laundry Bear has been targeting government and commercial organizations in Western countries by exploiting a zero-day vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite (ZCS) since at least July 2025. Unlike typical phishing, the attack requires only that a victim open a malicious email in a vulnerable Zimbra webmail interface, triggering exfiltration of up to 90 days of email, the Global Address List, and other sensitive data. AttackIQ has released 10 adversary emulation scenarios covering initial access, C2, and exfiltration behaviors. Recommended mitigations include immediately patching ZCS to versions 10.1.13 or 10.0.18, using alternative mail clients if patching is delayed, implementing passkey-based authentication, and deploying network monitoring to detect anomalous outbound data transfers and suspicious DNS activity. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Protecting Against Zero-Click Attacks](https://daily.dev/posts/protecting-against-zero-click-attacks-ge7fvclrn) · IT Security Guru · 0 upvotes · 0 comments - [Over 10,000 Zimbra servers vulnerable to ongoing XSS attacks](https://daily.dev/posts/over-10-000-zimbra-servers-vulnerable-to-ongoing-xss-attacks-f0dcy8pcn) · BleepingComputer · 0 upvotes · 0 comments - [Rapid7 Intelligence and Zimbra: When Business Email Compromise Starts Rewriting Reality](https://daily.dev/posts/rapid7-intelligence-and-zimbra-when-business-email-compromise-starts-rewriting-reality-zpplqnlin) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments --- Tags: [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/response-to-cisa-advisory-aa26-204a-russian-state-supported-cyber-actors-conduct-phishing-campaig-movbsbws5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Response to CISA Advisory (AA26-204A): Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite","url":"https://daily.dev/posts/response-to-cisa-advisory-aa26-204a-russian-state-supported-cyber-actors-conduct-phishing-campaig-movbsbws5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/response-to-cisa-advisory-aa26-204a-russian-state-supported-cyber-actors-conduct-phishing-campaig-movbsbws5"},"datePublished":"2026-07-27T23:19:10.443Z","dateModified":"2026-07-27T23:20:16.154Z","description":"CISA Advisory AA26-204A details how Russian state-sponsored threat actor Laundry Bear has been targeting government and commercial organizations in Western...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7bd7c2a750ab62b0a156d70aecc00375?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7bd7c2a750ab62b0a156d70aecc00375?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/response-to-cisa-advisory-aa26-204a-russian-state-supported-cyber-actors-conduct-phishing-campaig-movbsbws5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"phishing","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"Response to CISA Advisory (AA26-204A): Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite"}]} ```