Russian State-Sponsored Phishing Campaign Targeting Zimbra Collaboration Suite — Denver Operations Footprint

Declared from 2 signals. OVIX 10. News 1. BPO 3. High-confidence (auto).

Auto-validated: SEV3 per policy.

External corroboration: corroborated (5 sources via Exa). cisa.gov, media.defense.gov, bleepingcomputer.com, unit42.paloaltonetworks.com, proofpoint.com

Merged new cluster (1 signals, OVIX 10, regions Okc) — same underlying entity. Entity identity vendor:russian+state — collapsed across regions (agents-036 Gate 3, <14d window). Re-emission of already-tracked events only — material clock NOT advanced (agents-046 G5, quiet clock continues toward close).

Merged new cluster (1 signals, OVIX 10, regions Okc) — same underlying entity. Entity identity vendor:russian+state — collapsed across regions (agents-036 Gate 3, <14d window). Re-emission of already-tracked events only — material clock NOT advanced (agents-046 G5, quiet clock continues toward close).

Merged new cluster (1 signals, OVIX 10, regions Dfw) — same underlying entity. Entity identity vendor:operations+footprint — collapsed across regions (agents-036 Gate 3, <14d window). 1 genuinely-new material event — material clock advanced.

Merged new cluster (1 signals, OVIX 10, regions Dfw) — same underlying entity. Entity identity vendor:operations+footprint — collapsed across regions (agents-036 Gate 3, <14d window). Re-emission of already-tracked events only — material clock NOT advanced (agents-046 G5, quiet clock continues toward close).

Merged new cluster (2 signals, OVIX 10, regions Dfw) — same underlying entity. Entity identity vendor:russian+state — collapsed across regions (agents-036 Gate 3, <14d window). Re-emission of already-tracked events only — material clock NOT advanced (agents-046 G5, quiet clock continues toward close).

Merged new cluster (2 signals, OVIX 10, regions Dfw) — same underlying entity. Entity identity vendor:russian+state — collapsed across regions (agents-036 Gate 3, <14d window). Re-emission of already-tracked events only — material clock NOT advanced (agents-046 G5, quiet clock continues toward close).

Auto-closed: no new material events within 36h for this incident.

Checked in order against open same-domain incidents (never an aggregate-titled bucket): (1) ENTITY key, region-independent, incident active <14d (updated_at): shared CVE id, OR (cyber) >=2 shared distinctive vendor/product tokens (1 suffices when it carries a digit, i.e. a product model), OR (travel, agents-039) same travel operator/system key (travelSystemKey — airline/ATC/GDS/rail identity with a disruption cue), OR same network/AS key (agents-022). (2) EPISODE key (weather/environmental/disaster + travel per agents-039 + environmental air-quality per agents-040), incident active <7d: same hazard family (weather: heat/tornado/flood/cyclone/winter/wildfire/storm; travel: strike/ground_stop/airspace/it_outage/transit; environmental air-quality: air_quality/smoke — a multi-day wildfire-smoke wave, split cleanly from the weather wildfire FIRE family) AND same macro-region (eu | us/<census region> | country code) — a multi-day strike series, rolling ground stop, or smoke wave refreshes ONE incident, not dailies. (3) Legacy region-overlap + title-word dedup, active <24h (v5 unchanged). Merge unions affected_regions + related_signal_ids + material_event_keys, bumps event_count, renders the merged regions into the description ("Affected regions:" trailer), logs stage=declare decision=merge (engine deterministic), and unions the evidence projection’s signal sources. agents-046 (v4): a merge advances the material clock (last_material_event_at) ONLY when it brings GENUINELY-NEW material event keys (newMaterialKeys over the incident's material_event_keys, agents-010 Fault B) — an EVOLVING situation. Re-emission / continued press coverage of already-tracked events accumulates ids/regions/event_count but HOLDS the material clock (agents-019 §C), so a wallpaper advisory's quiet clock can finally elapse toward close. This is the evolving-vs-wallpaper discriminator the earned-rights lifecycle backstop (incident_lifecycle v1) reads.

agents-043 (v4): a Gate A workforce-footprint declaration (geoExposureFloor) is scored on VALUE = magnitude × footprint via workforceFootprintSeverity, NOT the base mapSevLevel: catastrophic (sev>=9) × MAJOR hub (bpo>=3) → SEV1 (the Manila 7.0-quake worked example — this deliberately supersedes the single-event cap per ALERTING-PHILOSOPHY.md / Ted's criteria); sev>=9 × moderate hub (bpo==2) → SEV2; sev>=8 × bpo>=2 → SEV3. SEV1/SEV2 remain human-gated at declaration (validation pending). Every other path keeps the base mapSevLevel below unchanged. agents-046 (v5): the named-tropical-system active-threat arm (workforceFootprintSeverity tropicalActiveThreat, sev 7–7.99 × bpo>=2) → SEV3 — a tracked storm approaching a footprint coast is a genuine 0–72h disruption a WFM leader pre-positions for (same SEV3 honesty as the acute-severe-weather floor). The flag is a no-op for sev>=8 (those hit the higher branches), so hurricanes are unaffected. Base: SEV2 if sev>=9 AND news>=2 AND bpo>=1; else SEV3 if sev>=8 AND (news>=1 OR bpo>=1); else SEV4. Acute severe-weather (agents-028): if sev>=9 floor to SEV3 (SEV2→SEV3); minor/transient watches+advisories drop SEV2/SEV3→SEV4. Single-event cap: any SEV2 caps to SEV3 absent sustained multi-day BPO-region corroboration (SEV2 promotion is human-gated via revalidation). Systemic-travel floor (agents-039): a travelSystemicFloor declaration (multi-signal aggregate on member-relevant geography, sev 6-7 by design) floors SEV4→SEV3 — a region-level operational disruption, same honesty argument as the acute-weather SEV3 floor. It never raises anything to SEV2: SEV2 keeps its base intensity+news+human gating. Environmental air-quality floor (agents-040): an enviroAirQualityFloor declaration (multi-city cumulative air-quality/smoke aggregate on member-relevant geography, sev 6-7 by design) likewise floors SEV4→SEV3, and never raises anything to SEV2. score = numeric SEV (1=most severe … 4); SEV3/SEV4 auto-validate, SEV1/SEV2 require human validation.