Loading story…
Researchers exposed a major OPSEC failure by FancyBear/APT28 that revealed an active espionage operation, tracked as Operation Roundish, targeting government and military organizations across Europe. An exposed NameCheap VPS at 203.161.50.145, previously linked to the group by CERT-UA, remained in use for more than 500 days and contained a publicly accessible directory with stolen data and operational artifacts. Hunt.io first documented the campaign from an exposed directory scan, and follow-on analysis found the same infrastructure held 2,800+ exfiltrated emails, 240+ stolen credential sets including passwords and TOTP 2FA secrets, 140+ malicious email-forwarding rules, and 11,500+ harvested contact addresses from victim mailboxes.
Further investigation uncovered a second exposed directory on the same server containing FancyBear’s C2 source code, additional JavaScript payloads, telemetry logs, and evidence of broader collection activity. The operation affected entities in Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia, including addresses associated with four NATO member states and NATO-linked targets. Researchers also reported a previously unreported SquirrelMail XSS payload, indicating the campaign targeted multiple webmail platforms and used mailbox compromise, silent forwarding, and credential theft to sustain long-term intelligence collection.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Researchers disclosed that FancyBear used JavaScript, including keyTwoAuth.js, to steal TOTP secrets from Roundcube sessions via the twofactorgauthenticator plugin, enabling persistent 2FA bypass. The exposed logs showed 516 entries across 108 victim addresses, including targets in Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia, some linked to NATO member states and infrastructure.
Ctrl-Alt-Intel and Hunt.io uncovered another open directory on the same NameCheap VPS, exposing source code, payloads, telemetry logs, exfiltrated emails, stolen credentials, forwarding rules, and harvested contacts. The exposure provided rare visibility into an active APT28 espionage operation.
Breakglass Intelligence reported that APT28 used weaponized RTF documents impersonating Ukrainian emergency correspondence to coerce Windows into sending NTLMv2 hashes to attacker-controlled infrastructure via a WebDAV UNC path. The campaign primarily targeted the Ukrainian State Hydrometeorological Center and also included parallel targeting tied to Ukraine, a German-speaking European target, and Turkey.
Ctrl-Alt-Intel said its findings expanded on Hunt.io's March 2026 reporting about Operation Roundish. Hunt.io had already identified exposed FancyBear infrastructure tied to the campaign before the follow-on analysis.
Ctrl-Alt-Intel reported that the FancyBear/APT28 server at 203.161.50.145 was used for espionage operations from at least September 2024. The infrastructure supported Operation Roundish activity against government and military webmail users in Eastern and Southeastern Europe.
The reporting states the same VPS remained in use despite prior public attribution by CERT-UA, indicating the infrastructure had already been linked to APT28 before March 2026. The exact attribution date is not specified in the references.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcectrlaltintel.com
Open sourceintel.breakglass.tech
Open sourcectrlaltintel.com
Open sourcectrlaltintel.com
Open sourcectrlaltintel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recorded Future’s Insikt Group reported sustained **credential-harvesting operations by Russia-linked APT28** (aka **BlueDelta/Fancy Bear**) targeting individuals tied to a Turkish energy and nuclear research agency, European think tanks, and organizations in **North Macedonia and Uzbekistan**. Activity observed from **February to September 2025** used regionally tailored lures aligned with Russian intelligence priorities around energy, defense, and policy, with victims redirected to legitimate sites after credential theft to reduce suspicion. The campaigns relied on **fake login portals** impersonating *Microsoft Outlook/OWA*, *Google*, and *Sophos VPN* to capture credentials, and used low-cost, resilient infrastructure including free hosting and tunneling services (e.g., `ngrok`, Webhook[.]site, InfinityFree, and Byet Internet Services) to host pages and exfiltrate data. Multiple operations incorporated **legitimate PDF lure documents** (e.g., think tank and foundation publications) to increase authenticity and bypass email security controls, reflecting continued emphasis on scalable credential theft rather than novel malware deployment.
Jun 29, 2026
Russia-aligned espionage groups **TA458** and **TA488** have been exploiting vulnerabilities in webmail platforms including **Roundcube, Zimbra, SOGo, mDaemon, Kerio,** and **SOGo** to compromise government and defense targets through so-called **"half-click"** attacks, where opening a malicious email in a webmail session triggers attacker-controlled JavaScript. Proofpoint reported TA458 used a **SOGo zero-day** later patched as `CVE-2026-8496`, while TA488 exploited a previously unknown **Zimbra** flaw assigned `CVE-2025-66376` for months. The campaigns targeted Ukrainian government entities, Eastern European military and government organizations, and parts of the U.S. defense industrial base and nuclear sector, with malware such as **SpyPress** and **ZimReaper** stealing credentials, contacts, emails, CSRF tokens, and app-specific passwords to bypass multifactor protections. Reporting on **APT28** infrastructure exposed in early 2026 tied the broader **Operation RoundPress** activity to a larger webmail espionage program that relied heavily on patched but unremediated flaws, including `CVE-2020-35730`, `CVE-2023-43770`, `CVE-2021-44026`, and `CVE-2020-12641` in Roundcube. Researchers said the leaked toolkit included XSS payloads, a Flask-based command-and-control server, a Go implant for GNU/Linux, operator bash history, and victim data, revealing poor operational security and overlap between staging, exfiltration, and pivot infrastructure. TA458 was also observed chaining a Roundcube XSS vector with `CVE-2025-49113` to achieve PHP deserialization and arbitrary code execution, showing that the actors are pursuing not only mailbox theft and forwarding-rule abuse but also persistent server-side access.
Aug 11, 2026
**Fancy Bear (APT28)** has been attributed with high confidence to *Operation Neusploit*, a campaign targeting users in Central and Eastern Europe by weaponizing **CVE-2026-21509**, a **Microsoft RTF** parsing zero-day that enables arbitrary code execution via specially crafted RTF documents. Reported lures were written in multiple languages (including English, Romanian, Slovak, and Ukrainian) and targeted victims in **Ukraine, Slovakia, and Romania**. Microsoft issued an **out-of-band patch** for CVE-2026-21509 on **January 26, 2026**, with in-the-wild exploitation observed shortly after. Post-exploitation activity was described as a multi-stage chain that retrieves a malicious dropper DLL from attacker infrastructure and then deploys different payload paths, including **MiniDoor** (focused on Outlook email theft/exfiltration) and **PixyNetLoader**, which ultimately leads to a **Covenant Grunt** implant for command-and-control. The campaign also uses **evasion and targeting controls**, including region-restricted payload delivery (e.g., only serving malicious DLLs to requests from targeted geographies and specific `User-Agent` patterns) and persistence techniques such as **COM hijacking**, plus additional tradecraft like **steganography in PNG files** and shellcode loading to execute the final implant.
Jun 29, 2026