Loading story…
Researchers and government agencies reported that the Russia-linked APT28 espionage cluster has continued and expanded Operation RoundPress, a campaign that compromises vulnerable webmail platforms when targets open specially crafted phishing emails. ESET said the operation began against Roundcube and later spread to Horde, MDaemon, and Zimbra, using cross-site scripting flaws to inject malicious JavaScript into active mail sessions and steal credentials, emails, contacts, and in some cases 2FA secrets and app passwords. Proofpoint said the activity persisted into 2026 with a new “half-click” zero-day in SOGo tracked as CVE-2026-8496, while also noting exploitation against Zimbra, MDaemon, Kerio, and Roundcube and a modified SpyPress chain that paired a Roundcube XSS vector with CVE-2025-49113 to pursue server-side code execution and longer-term access.
The victim set has centered on government, military, diplomatic, and defense-related organizations, especially in Ukraine and Eastern Europe, but reporting also identified targets in France, Africa, Europe, and South America. ANSSI said French entities have faced repeated APT28 intrusions since 2021 using phishing, webmail brute force, edge-device compromise, and exploitation of flaws including CVE-2023-23397, with recurring Roundcube-focused operations and credential theft infrastructure. CERT-UA separately linked a phishing campaign against Ukrainian local government bodies to UAC-0001/APT28 with medium confidence, citing infrastructure overlap with an earlier Roundcube compromise involving CVE-2023-43770 that stole mailbox credentials and created malicious mail-forwarding rules. Across the reporting, the campaign is described as a strategic intelligence-collection effort tied to Russian state interests and the war in Ukraine.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
Proofpoint observed TA458 modifying its Roundcube-focused SpyPress variant to chain a Roundcube XSS vector with CVE-2025-49113, enabling PHP deserialization and arbitrary code execution for longer-term server access.
Proofpoint said the SOGo zero-day used by TA458 was disclosed to Alinto and patched in SOGo version 5.12.8 as CVE-2026-8496.
Proofpoint reported that in March 2026 TA458 exploited a zero-day in SOGo webmail against government-focused targets using a half-click attack that triggered when victims opened a malicious email.
On July 15, 2026, Proofpoint reported that TA458 continued targeting government webmail servers with half-click exploits against SOGo, Zimbra, mDaemon, Kerio, and Roundcube, and assessed the actor is likely linked to the Russian GRU.
CERT-UA reported an ongoing phishing campaign targeting Ukrainian local self-government bodies with fake Google Sheets lures that trick users into executing PowerShell, leading to browser data theft, SSH tunneling, and Metasploit payload delivery. CERT-UA attributed the activity with medium confidence to UAC-0001 (APT28).
CERT-UA linked current activity to a September 2024 incident in which a Roundcube exploit, CVE-2023-43770, was used to steal mailbox credentials and create a mail-forwarding filter via the ManageSieve plugin.
ANSSI reported that APT28 activity affecting France in 2024 particularly emphasized governmental, diplomatic, and research targets.
ANSSI described a 2023 campaign in which APT28 used InfinityFree to deliver the HeadLace backdoor and Mocky.IO for command distribution.
On May 15, 2025, ESET published research on Operation RoundPress, describing a webmail-focused cyberespionage campaign and assessing with medium confidence that it is operated by Sednit/APT28.
ESET reported that Operation RoundPress used the MDaemon zero-day CVE-2024-11182 and that the flaw was patched in MDaemon version 24.5.1 after ESET disclosed it.
ESET said that in 2024 the RoundPress campaign expanded beyond Roundcube to target Horde, MDaemon, and Zimbra webmail servers, continuing to focus on governmental and defense-related organizations.
ESET reported that Operation RoundPress targeted Roundcube webmail servers in 2023 using spearphishing emails that exploited XSS flaws to inject malicious JavaScript into victims' webmail sessions.
The ANSSI report places APT28 espionage activity in the context of Russia's war against Ukraine, which began on February 24, 2022, and notes campaigns against Ukraine, NATO countries, and EU member states.
ANSSI and C4 partners reported observing the targeting and compromise of French entities by the APT28 intrusion set beginning in 2021 for strategic intelligence collection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
proofpoint.com
Open sourcewelivesecurity.com
Open sourcecert.ssi.gouv.fr
Open sourcecert.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russia-aligned espionage groups **TA458** and **TA488** have been exploiting vulnerabilities in webmail platforms including **Roundcube, Zimbra, SOGo, mDaemon, Kerio,** and **SOGo** to compromise government and defense targets through so-called **"half-click"** attacks, where opening a malicious email in a webmail session triggers attacker-controlled JavaScript. Proofpoint reported TA458 used a **SOGo zero-day** later patched as `CVE-2026-8496`, while TA488 exploited a previously unknown **Zimbra** flaw assigned `CVE-2025-66376` for months. The campaigns targeted Ukrainian government entities, Eastern European military and government organizations, and parts of the U.S. defense industrial base and nuclear sector, with malware such as **SpyPress** and **ZimReaper** stealing credentials, contacts, emails, CSRF tokens, and app-specific passwords to bypass multifactor protections. Reporting on **APT28** infrastructure exposed in early 2026 tied the broader **Operation RoundPress** activity to a larger webmail espionage program that relied heavily on patched but unremediated flaws, including `CVE-2020-35730`, `CVE-2023-43770`, `CVE-2021-44026`, and `CVE-2020-12641` in Roundcube. Researchers said the leaked toolkit included XSS payloads, a Flask-based command-and-control server, a Go implant for GNU/Linux, operator bash history, and victim data, revealing poor operational security and overlap between staging, exfiltration, and pivot infrastructure. TA458 was also observed chaining a Roundcube XSS vector with `CVE-2025-49113` to achieve PHP deserialization and arbitrary code execution, showing that the actors are pursuing not only mailbox theft and forwarding-rule abuse but also persistent server-side access.
Jul 23, 2026
Ukrainian officials warned that Russia-linked hackers are revisiting earlier compromises to regain access to government and defense networks, testing whether old footholds, unpatched vulnerabilities, and previously stolen credentials still work. CERT-UA said the activity reflects a broader shift from smash-and-grab credential theft toward persistent access, with initial intrusion methods also evolving beyond phishing to more tailored social engineering, including phone calls and video chats in fluent Ukrainian before malicious files are delivered through messaging apps. Agencies tied the activity to groups including **APT28** and **Void Blizzard**, with the security and defense sector remaining the top target because disruptions there could affect the war effort. Ukraine also confirmed a long-running cyber-espionage campaign, tracked since 2023 and attributed by Western researchers to **APT28** (`Fancy Bear`, `BlueDelta`, `Forest Blizzard`), that targeted prosecutors, anti-corruption bodies, and other local government entities through **Roundcube** webmail vulnerabilities enabling code execution when a victim opened an email. Reuters reported that more than 170 email accounts belonging to prosecutors and investigators were compromised in recent months, and CERT-UA identified three waves of related attacks. Officials said some allegedly stolen material was later published online, though reviews indicated the leaks likely did not include confidential data, and warned the operation could still be used to fuel disinformation aimed at eroding trust in Ukrainian institutions.
Jun 29, 2026
**APT28**, the Russia-linked threat group associated with the GRU, used a phishing campaign dubbed *Operation GhostMail* to target Ukrainian government entities by exploiting **Zimbra Collaboration Suite** vulnerability `CVE-2025-66376`. The campaign targeted the **State Hydrographic Service of Ukraine**, a critical infrastructure body supporting maritime navigation and hydrographic operations. The attack used a single email written in Ukrainian and disguised as a routine internship inquiry; instead of relying on attachments or links, the malicious payload was embedded directly in the HTML body and executed when opened in a vulnerable Zimbra webmail session. Researchers said the stored XSS flaw allowed attackers to run obfuscated JavaScript in the victim’s browser, enabling theft of login credentials, session tokens, backup two-factor authentication codes, browser-stored passwords, and up to 90 days of mailbox data. Reporting also notes the flaw was patched in November and later added by **CISA** to its **Known Exploited Vulnerabilities** catalog, with U.S. federal civilian agencies ordered to remediate within two weeks under `BOD 22-01`. The operation stood out for abusing a trusted webmail environment to hijack authenticated sessions without deploying traditional malware, helping the intrusion evade many standard phishing and endpoint defenses.
Jun 29, 2026