Loading story…
Russia-aligned espionage groups TA458 and TA488 have been exploiting vulnerabilities in webmail platforms including Roundcube, Zimbra, SOGo, mDaemon, Kerio, and SOGo to compromise government and defense targets through so-called "half-click" attacks, where opening a malicious email in a webmail session triggers attacker-controlled JavaScript. Proofpoint reported TA458 used a SOGo zero-day later patched as CVE-2026-8496, while TA488 exploited a previously unknown Zimbra flaw assigned CVE-2025-66376 for months. The campaigns targeted Ukrainian government entities, Eastern European military and government organizations, and parts of the U.S. defense industrial base and nuclear sector, with malware such as SpyPress and ZimReaper stealing credentials, contacts, emails, CSRF tokens, and app-specific passwords to bypass multifactor protections.
Reporting on APT28 infrastructure exposed in early 2026 tied the broader Operation RoundPress activity to a larger webmail espionage program that relied heavily on patched but unremediated flaws, including CVE-2020-35730, CVE-2023-43770, CVE-2021-44026, and CVE-2020-12641 in Roundcube. Researchers said the leaked toolkit included XSS payloads, a Flask-based command-and-control server, a Go implant for GNU/Linux, operator bash history, and victim data, revealing poor operational security and overlap between staging, exfiltration, and pivot infrastructure. TA458 was also observed chaining a Roundcube XSS vector with CVE-2025-49113 to achieve PHP deserialization and arbitrary code execution, showing that the actors are pursuing not only mailbox theft and forwarding-rule abuse but also persistent server-side access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Proofpoint research summarized that TA488 used a previously unknown Zimbra vulnerability later assigned CVE-2025-66376 for at least five months in 2025. The group used a half-click technique in which opening an email triggered malicious JavaScript in the victim's authenticated webmail session.
A SecurityOnline report summarized Proofpoint's research on the Russia-aligned groups TA488 and TA458, including TA488's ZimReaper activity and TA458's Operation RoundPress targeting of multiple webmail platforms. It also noted U.S. government partners linked TA488 to Void Blizzard and described TA458 as likely GRU-directed according to Proofpoint.
The broader Operation RoundPress campaign was linked by ESET to targets in Ukraine, Bulgaria, and Romania, tying the webmail espionage activity to government-focused targeting in the region.
Proofpoint reported that TA458 continued targeting government webmail servers across platforms including Zimbra, mDaemon, Kerio, Roundcube, and SOGo using half-click exploits. The company also said TA458 modified its Roundcube-focused SpyPress variant to chain an XSS vector with CVE-2025-49113 for PHP deserialization and arbitrary code execution.
In March 2026, TA458 exploited a zero-day in SOGo webmail as part of Operation RoundPress. Proofpoint said the flaw was disclosed to Alinto and later patched as CVE-2026-8496 in SOGo version 5.12.8.
In January 2026, Hunt.io found an exposed directory on server 203.161.50.145 containing a full APT28 toolkit used in attacks against Roundcube webmail. The exposed contents reportedly included operator bash history, XSS payloads, a Flask-based C2, a Go implant, victim data, and links to Oracle Cloud pivot infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecodeby.net
Open sourceproofpoint.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and government agencies reported that the Russia-linked **APT28** espionage cluster has continued and expanded **Operation RoundPress**, a campaign that compromises vulnerable webmail platforms when targets open specially crafted phishing emails. ESET said the operation began against **Roundcube** and later spread to **Horde, MDaemon, and Zimbra**, using cross-site scripting flaws to inject malicious JavaScript into active mail sessions and steal credentials, emails, contacts, and in some cases **2FA secrets** and app passwords. Proofpoint said the activity persisted into 2026 with a new “half-click” zero-day in **SOGo** tracked as `CVE-2026-8496`, while also noting exploitation against **Zimbra, MDaemon, Kerio, and Roundcube** and a modified SpyPress chain that paired a Roundcube XSS vector with `CVE-2025-49113` to pursue server-side code execution and longer-term access. The victim set has centered on **government, military, diplomatic, and defense-related organizations**, especially in **Ukraine and Eastern Europe**, but reporting also identified targets in **France, Africa, Europe, and South America**. ANSSI said French entities have faced repeated APT28 intrusions since 2021 using phishing, webmail brute force, edge-device compromise, and exploitation of flaws including `CVE-2023-23397`, with recurring Roundcube-focused operations and credential theft infrastructure. CERT-UA separately linked a phishing campaign against Ukrainian local government bodies to **UAC-0001/APT28** with medium confidence, citing infrastructure overlap with an earlier **Roundcube** compromise involving `CVE-2023-43770` that stole mailbox credentials and created malicious mail-forwarding rules. Across the reporting, the campaign is described as a strategic intelligence-collection effort tied to Russian state interests and the war in Ukraine.
Jul 23, 2026
**APT28**, the Russia-linked threat group associated with the GRU, used a phishing campaign dubbed *Operation GhostMail* to target Ukrainian government entities by exploiting **Zimbra Collaboration Suite** vulnerability `CVE-2025-66376`. The campaign targeted the **State Hydrographic Service of Ukraine**, a critical infrastructure body supporting maritime navigation and hydrographic operations. The attack used a single email written in Ukrainian and disguised as a routine internship inquiry; instead of relying on attachments or links, the malicious payload was embedded directly in the HTML body and executed when opened in a vulnerable Zimbra webmail session. Researchers said the stored XSS flaw allowed attackers to run obfuscated JavaScript in the victim’s browser, enabling theft of login credentials, session tokens, backup two-factor authentication codes, browser-stored passwords, and up to 90 days of mailbox data. Reporting also notes the flaw was patched in November and later added by **CISA** to its **Known Exploited Vulnerabilities** catalog, with U.S. federal civilian agencies ordered to remediate within two weeks under `BOD 22-01`. The operation stood out for abusing a trusted webmail environment to hijack authenticated sessions without deploying traditional malware, helping the intrusion evade many standard phishing and endpoint defenses.
Jun 29, 2026
Palo Alto Networks Unit 42 reported that a cyberespionage campaign tracked as **CL-STA-1114**, overlapping with activity attributed by other vendors to **Void Blizzard** and **LAUNDRY BEAR**, has been exploiting **Zimbra Collaboration Suite** webmail servers at government, defense, transportation, and financial organizations. The activity has affected targets across NATO member states, Ukraine, CIS countries, and Africa, with researchers saying the broader cluster has been active since at least 2024 and Zimbra-focused operations began in July 2025. The attackers used zero-click phishing emails to exploit **`CVE-2025-66376`** in Zimbra webmail, allowing a malicious JavaScript payload to run in victims’ browsers without user interaction. Unit 42 said the malware can steal Zimbra credentials, CSRF tokens, 2FA scratch codes, system details, and up to 90 days of email and search history. Researchers also identified at least nine IP addresses and nine domains tied to command-and-control infrastructure, with servers remaining active for an average of 35.4 days, and warned that unpatched Zimbra instances are being actively targeted.
Jul 24, 2026