TA458, a Russia-aligned espionage actor tracked as the operator behind Operation RoundPress, continues leveraging half-click XSS exploits against webmail platforms (SOGo, Kerio, Zimbra, mDaemon, Roundcube) to compromise government and military targets across Ukraine and Eastern Europe without requiring victim interaction beyond viewing a malicious email. The actor deploys the customized, obfuscated SpyPress JavaScript implant to steal credentials, contacts, and emails, and has recently pivoted its Roundcube variant toward establishing long-term server access via a chained PHP deserialization exploit (CVE-2025-49113) that installs multiple redundant reverse-shell and webshell persistence mechanisms.
half-click exploit
2 posts
Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days from TA458 TA488 Targets Zimbra Mailservers with Half-Click Exploits TA488, a Russia-aligned threat actor linked with medium confidence to Void Blizzard/Laundry Bear, exploited a zero-day flaw (CVE-2025-66376) in Zimbra's client-side HTML sanitizer using a tag-splitting technique with fake CSS @import directives to smuggle executable SVG/JavaScript payloads. The resulting malware, ZimReaper, requires only that a victim open/preview a crafted email in vulnerable Zimbra webmail to execute in the browser context, harvesting CSRF tokens, autofill credentials, and 2FA codes, establishing a persistent app-specific password bypassing MFA, and exfiltrating Global Address List data and up to 90 days of email via DNS tunneling and HTTP POST to Cloudflare-fronted C2 infrastructure. Targeting focused on Ukrainian government and US government/science/defense industrial base entities, with the campaign going dormant after public disclosure by Seqrite in early 2026.