SpyPress
SpyPress is an obfuscated JavaScript payload used in the Russia-linked Operation RoundPress webmail espionage campaign, which ESET attributed with medium confidence to APT28 (Fancy Bear/Sednit/GRU Unit 26165). The malware is delivered through crafted emails that exploit cross-site scripting vulnerabilities in webmail platforms including Roundcube, Horde, MDaemon, Zimbra, and related variants. Successful exploitation requires the victim to open the malicious email in a vulnerable webmail portal, after which SpyPress executes in the browser context of the authenticated session. Its documented capabilities include theft of webmail credentials, harvesting of email messages and contact information, and exfiltration of stolen data via HTTP POST to a hard-coded command-and-control server. Some variants also captured login history and two-factor authentication codes; Roundcube-specific variants could create Sieve forwarding rules to send copies of incoming mail to an attacker-controlled address, and MDaemon-focused variants could create an application password to retain mailbox access. SpyPress generally did not include a standalone persistence mechanism, but it would execute again whenever the booby-trapped email was reopened. Reported targeting focused primarily on governmental entities and defense companies, especially in Eastern Europe and Ukraine, with additional targets in Europe, Africa, and South America. Supporting reporting also notes strong TTP overlap between SpyPress and the later Roundish toolkit, including webmail credential theft, mailbox exfiltration, contact theft, Sieve-rule persistence, and 2FA-related collection.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"Assigned the CVE identifier CVE-2024-11182 (CVSS score: 5.3), it was patched in version 24.5.1 last November." | Successful exploitation leads to the execution of an obfuscated JavaScript payload named SpyPress that comes with the ability to steal webmail credentials and harvest email messages and contact information from the victim's mailbox.
Successful exploitation leads to the execution of an obfuscated JavaScript payload named SpyPress that comes with the ability to steal webmail credentials and harvest email messages and contact information from the victim's mailbox. | "It's worth noting that CVE-2023-43770 was added by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its Known Exploited Vulnerabilities (KEV) catalog in February 2024."
"...Roundcube (CVE-2023-43770), and Zimbra (CVE-2024-27443) leveraged security defects already known and patched..." | Successful exploitation leads to the execution of an obfuscated JavaScript payload named SpyPress that comes with the ability to steal webmail credentials and harvest email messages and contact information from the victim's mailbox.
Successful exploitation leads to the execution of an obfuscated JavaScript payload named SpyPress that comes with the ability to steal webmail credentials and harvest email messages and contact information from the victim's mailbox.
Successful exploitation leads to the execution of an obfuscated JavaScript payload named SpyPress that comes with the ability to steal webmail credentials and harvest email messages and contact information from the victim's mailbox.
Successful exploitation leads to the execution of an obfuscated JavaScript payload named SpyPress that comes with the ability to steal webmail credentials and harvest email messages and contact information from the victim's mailbox.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The payload family is tracked as SpyPress, with one variant per webmail platform (Roundcube, Horde, MDaemon, Zimbra).
We identified 14 TTP overlaps between the Roundish toolkit and ESET's documented Operation RoundPress campaign... Its presence in both SpyPress and Roundish strongly suggests a shared developer or development playbook.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Initial Access
2 techniques
Initial Access
Execution
1 technique
Execution
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A payload family used in webmail XSS operations to exfiltrate mailbox contents, contacts, and credentials, with platform-specific variants.
A webmail-focused XSS toolkit (documented by ESET in Operation RoundPress) used for credential theft (including hidden-form autofill capture), mail-forwarding rule creation for persistence, and MFA bypass via TOTP secret/app-password exfiltration; referenced here as the closest prior public analogue to Roundish.
Obfuscated JavaScript payload delivered via XSS in webmail clients; steals webmail credentials and exfiltrates mailbox data (emails, contacts). Some variants can capture login history and 2FA codes, create an application password in MDaemon for continued access, and (SpyPress.ROUNDCUBE) create Roundcube Sieve rules to auto-forward incoming mail to an attacker-controlled address. Exfiltrates data via HTTP POST to a hard-coded C2. Lacks native persistence but is reloaded when the malicious email is opened; Sieve-rule capability provides durable collection.
Operation RoundPress SpyPress
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.