AA26-204A — CISA/FBI Joint Advisory on Russian Zimbra Phishing Campaign

AA26-204A is a joint cybersecurity advisory published July 25, 2026 by CISA and international partners detailing a Russian state-sponsored phishing campaign targeting users of the Zimbra Collaboration Suite.

Summary

The advisory provides:

• Indicators of Compromise (IOCs)
• Tactics, Techniques, and Procedures (TTPs)
• Mitigation guidance for organisations using Zimbra

Campaign

Russian state-sponsored threat actors are conducting targeted phishing operations against Zimbra webmail users. The advisory is a coordinated international effort to raise awareness and provide defensive guidance.

Related Pages

• Aa26 204A Russian Zimbra Campaign — Previous advisory on Zimbra zero-day exploitation (CVE-2025-66376)

Source

• CISA — July 25, 2026