THREAT OPS › Threat News › Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite
Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite
<div class="c-page-title__buttons"><a class="c-button" href="https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF">Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite</a></div> <h2><strong>Executive summary</strong> </h2> <p>A group of Russian state-supported cyber actors has been targeting and
MITRE ATT&CK techniques
- Adversary-in-the-MiddleT1557
- Acquire InfrastructureT1583
- Purchase Technical DataT1597.002
- Artificial IntelligenceT1588.007
- Encrypted/Encoded FileT1027.013
- JavaScriptT1059.007
- Email CollectionT1114
- DNS ServerT1583.002
- MalwareT1587.001
- VulnerabilitiesT1588.006
- Automated CollectionT1119
- Remote Data StagingT1074.002
- Virtual Private ServerT1584.003
- Social EngineeringT1684
- MasqueradingT1036
- Email AccountT1087.003
- Use Alternate Authentication MaterialT1550
- Gather Victim Identity InformationT1589
- Archive Collected DataT1560
- Browser Session HijackingT1185
- Search Open Technical DatabasesT1596
- Active ScanningT1595
- Password SprayingT1110.003
- Email AddressesT1589.002
- Account DiscoveryT1087
- SVG SmugglingT1027.017
- Virtual Private ServerT1583.003
- Data StagedT1074
- Stage CapabilitiesT1608
- Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1048.002
- Trusted RelationshipT1199
- Search Open Websites/DomainsT1593
- Account ManipulationT1098
- Exfiltration Over Alternative ProtocolT1048
- ToolT1588.002
- Search Closed SourcesT1597
- PhishingT1566
- Valid AccountsT1078
- Obfuscated Files or InformationT1027
- Multi-Factor AuthenticationT1556.006
- Remote Email CollectionT1114.002
- ExploitsT1587.004
- CredentialsT1589.001
- Exploitation for Client ExecutionT1203
- DNS ServerT1584.002
- Web Session CookieT1550.004
- Obtain CapabilitiesT1588
- Command ObfuscationT1027.010
- Scan DatabasesT1596.005
- Develop CapabilitiesT1587
- Modify Authentication ProcessT1556
- Exfiltration Over Unencrypted Non-C2 ProtocolT1048.003
- CompressionT1027.015
- Search Open Technical DatabasesAML.T0000
- Active ScanningAML.T0006
- Acquire InfrastructureAML.T0008
- Valid AccountsAML.T0012
- Obtain CapabilitiesAML.T0016
- Develop CapabilitiesAML.T0017
- MasqueradingAML.T0074
- Stage CapabilitiesAML.T0079
- Gather Victim Identity InformationAML.T0087
- Use Alternate Authentication MaterialAML.T0091
- Search Open Websites/DomainsAML.T0095
Indicators of compromise
- ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629sha256
- 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aafsha256
- 60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874sha256
- b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1dsha256
- 1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760sha256
- 2e4f314bc9943cab5005d6fde0b271c74d47bc9dsha1
- 50a87d926621dd06389ba50d86e0ff574ed713a8sha1
- c5a72420e7bb308d078e62128430897f82194c95sha1
- 8959c4d29e29f02ea94ea8bb21c8df2594c5549dsha1
- 62eb76432597694edb01c1fe57aab0cfe03a7178sha1
- cddf5c3be1e07f28140aed165b929bf2d614922asha1
- 18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8sha1
- 1b25041ececf2457eef0270fc1d785cec8ec9dedsha1
- e4fe6466a4f9a4249fe330651e914e45bbdca44asha1
- b6b77c9a455225d525834a403ca9ef5481ed0447sha1
- CVE-2025-66376cve
- https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDFurl
- https://www.cve.org/CVERecord?id=CVE-2025-66376url
- https://www.ncsc.gov.uk/collection/vulnerability-management/guidance/responding-to-active-exploitationurl
- https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdfurl
- https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploiturl
- https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/url
- https://www.ic3.gov/url
- https://dibnet.dod.mil/url
- https://dibnet.dod.milurl
- http://www.ncis.navy.mil/url
- https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheidurl
- https://www.aivd.nl/url
- https://www.aivd.nlurl
- https://www.cyber.gov.au/about-us/about-asd-acsc/contact-us#no-backurl
- https://www.cyber.gc.ca/en/incident-managementurl
- https://ncsc.gov.uk/report-an-incidenturl
- https://supo.fi/en/contacturl
- https://www.sicurezzanazionale.gov.it/url
- ivanka.zurabishvili@proton.meemail
- zmul1@buildandconsulting.comemail
- garrysmithme@pinmx.netemail
- hostingclient@pinmx.netemail
- c.laurent.ejfa@proton.meemail
- j.moreau.epsc@proton.meemail
Original source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a