TA458

TA458 is a Russia-aligned cyberespionage threat actor responsible for Operation RoundPress, a campaign focused on exploiting webmail platforms to steal credentials, contacts, and sensitive email data. Its principal targets are Ukrainian government entities and government and military organizations in Eastern Europe, with documented targeting in Albania, Greece, Moldova, and Türkiye. It also occasionally targets chemical, telecommunications, and technology companies. TA458 delivers exploit-bearing messages through actor-controlled and compromised email accounts. Its half-click attacks exploit cross-site scripting vulnerabilities that execute malicious JavaScript when a recipient opens an email in a vulnerable webmail viewer, without requiring a link click or attachment execution. The actor deploys SpyPress, a JavaScript malware family adapted to Zimbra, MDaemon, Roundcube, Kerio, and SOGo. Its exploitation includes Zimbra CVE-2025-27915, MDaemon CVE-2025-3929, and SOGo CVE-2026-8496 as zero-days, alongside the previously disclosed Roundcube vulnerabilities CVE-2023-43770 and CVE-2024-42009. TA458 uses JavaScript obfuscation and proxy services to conceal aspects of its operations. Since at least July 2025, TA458 has extended its Roundcube operations beyond mailbox theft to persistent server compromise. It chains webmail exploitation with CVE-2025-49113, an unsafe PHP deserialization vulnerability, to achieve arbitrary code execution. Its Roundcube-focused SpyPress variant attempts six fallback persistence and backdoor mechanisms, including reverse shells, remote payload retrieval, and PHP webshells.