CISA Advisory – Russian State-Supported Actors Exploit Zimbra Zero-Day in Ongoing Phishing and Espionage Campaign

(TLP:CLEAR) ACTION MAY BE REQUIRED for utilities using self-hosted Zimbra Collaboration Suite (ZCS) webmail, particularly deployments running versions prior to 10.1.13 or 10.0.18. Utilities that outsource technology support may need to consult their service providers for assistance with remediation actions.

Today, CISA, NSA, FBI, and more than 20 international partners released a joint advisory detailing an ongoing campaign by the Russian state-supported group tracked as LAUNDRY BEAR (also Void Blizzard) against users of Zimbra Collaboration Suite (ZCS)…