US EditionSpies hack high-value mail servers using an exploit from yesteryear
- Security firm ESET reported in early 2025 that the Russia-linked Sednit group exploited cross-site scripting vulnerabilities to hack high-value mail servers worldwide.
- The operations, named RoundPress by ESET, used spearphishing emails delivering XSS exploits primarily targeting Roundcube, Horde, MDaemon, and Zimbra webmail software throughout 2023 and 2024.
- Sednit exploited both known and zero-day vulnerabilities such as the MDaemon zero-day CVE-2024-11182, deploying heavily obfuscated JavaScript payloads called SpyPress inside victims' webmail sessions.
- SpyPress stole credentials, emails, and contacts, bypassed two-factor authentication by creating app passwords, and used Sieve rules to forward incoming mail for persistent data exfiltration to attacker servers.
- The campaign focused on defense and government organizations linked to the Ukraine conflict in Eastern Europe and beyond, underscoring ongoing threats from unpatched webmail vulnerabilities.
11 Articles
11 Articles
Spies hack high-value mail servers using an exploit from yesteryear
Threat actors, likely supported by the Russian government, hacked multiple high-value mail servers around the world by exploiting XSS vulnerabilities, a class of bug that was among the most commonly exploited in decades past. XSS is short for cross-site scripting. Vulnerabilities result from programming errors found in webserver software that, when exploited, allow attackers to execute malicious code in the browsers of people visiting an affecte…
Spies hack high-value mail servers using an exploit from yesteryear - WorldNL Magazine
Threat actors, likely supported by the Russian government, hacked multiple high-value mail servers around the world by exploiting XSS vulnerabilities, a class of bug that was among the most commonly exploited in decades past. XSS is short for cross-site scripting. Vulnerabilities result from programming errors found in webserver software that, when exploited, allow attackers to execute malicious code in the browsers of people visiting an affecte…
Russian Hackers Exploit XSS Vulnerabilities to Inject Malicious Code into Email Servers
A sophisticated cyberespionage campaign, dubbed Operation RoundPress, has been uncovered by cybersecurity researchers at ESET. Attributed with medium confidence to the Russian-linked Sednit group-also known as APT28, Fancy Bear, and Forest Blizzard-this operation targets high-value webmail servers using cross-site scripting (XSS) vulnerabilities. Active since at least 2004, Sednit has a notorious history, including alleged involvement […] The po…
Coverage Details
Bias Distribution
- 50% of the sources lean Left
To view factuality data please Upgrade to Premium
Ownership
To view ownership data please Upgrade to Vantage
