type: incident · created: 2026-07-26 · updated: 2026-07-26 · tags: [incident, cisa, fbi, joint-advisory, russia, nation-state, zimbra, phishing, espionage] · confidence: high · affected_sectors: [government, technology] · au_impact: true
CISA/FBI Joint Advisory — Russian State-Sponsored Zimbra Phishing Campaign (Aa26 204A)
A joint cybersecurity advisory from CISA, FBI, and international partners detailing a Russian state-sponsored phishing campaign targeting users of the Zimbra Collaboration Suite.
Summary
| Field | Detail |
|---|---|
| Advisory ID | Aa26 204A |
| Attribution | Russian state-sponsored threat actors |
| Target | Zimbra Collaboration Suite users |
| Method | Targeted phishing campaigns |
| Date | July 25, 2026 |
The advisory provides indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and mitigation guidance for organisations using Zimbra.
Related Pages
- Aa26 204A — Shorter advisory page
- Aa26 204A Russian Zimbra Campaign — Related zero-day exploitation advisory
Source
- CISA — July 25, 2026