NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phishing Campaign

FORT MEADE, Md. (July 23, 2026) - Today, the National Security Agency (NSA) in collaboration with partners, is releasing a Cybersecurity Advisory (CSA) titled, "Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite."

Since July 2025, the Russian state-supported advanced persistent threat group known as LAUNDRY BEAR has utilized phishing emails to target the Zimbra Collaboration Suite (ZCS) across various U.S. and allied government and commercial networks. Supported by a custom-developed capability named "Ulej," the actors leverage a view-based exploit that triggers automatically when a user views a malicious email within a vulnerable version of the webmail service. This exploited a zero-day vulnerability (CVE-2025-66376) when it was first used by the threat group and is still used to successfully exploit ZCS instances that are still unpatched. The exploit attempts to exfiltrate the organization's email directory, the last 90 days of the victim's communications, and other sensitive information to servers controlled by the actors.

The joint CSA characterizes the network activity occurring during the exfiltration stage and documents observed indicators of comprise (IOCs) to help organizations develop robust detection and mitigation capabilities. The report also provides specific remediations steps for organizations that discover the presence of the listed IOCs.

Co-sealing agencies include the Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation, Department of Defense Cyber Crime Center, Department of Energy, Naval Criminal Investigative Service, Defense Counterintelligence and Security Agency, United States Cyber Command, Australian Signals Directorate's Australian Cyber Security Centre, Communication Security Establishment, Canada's Canadian Centre for Cyber Security, New Zealand National Cyber Security Centre, United Kingdom National Cyber Security Centre, Dutch General Intelligence and Security Service, Dutch Military and Intelligence Security Service, Finnish Security and Intelligence Service, Finnish Defence Intelligence Agency, French National Cybersecurity Agency, and Security and Intelligence Service of the Republic of Moldova.

Additional Resources

Read the full report.

Visit our full library for more cybersecurity information and technical guidance.

NSA Media Relations
[email protected]
443-634-0721

About the National Security Agency

Founded in 1952, NSA is a U.S. Department of War combat support agency and element of the U.S. Intelligence Community. The Agency's mission is to provide foreign signals intelligence to policy makers and our military, and to prevent and eradicate cybersecurity threats to U.S. National Security Systems, with a focus on the Defense Industrial Base and the improvement of U.S. weapons security. From protecting U.S. warfighters around the world to enabling and supporting operations on land, in the air, at sea, in space, and in the cyber domain, NSA is committed to building public trust through transparency and protecting civil liberties and privacy consistent with our nation's values.

###