TA458 / Operation RoundPress: a running supply of half-click webmail zero-days adds a fresh SOGo flaw (CVE-2026-8496)
Background. ESET first documented Operation RoundPress in 2025 as a Russia-aligned campaign abusing cross-site-scripting flaws in self-hosted webmail (initially Roundcube, later broadened) to steal mail from Ukrainian and Eastern-European government targets (ESET Research, 2025-05-15). It sits in a longer lineage of GRU-linked webmail-XSS espionage — the same tradecraft class CERT-UA, ANSSI and multiple vendors have tracked across APT28/Sofacy and WinterVivern operations against Roundcube and Zimbra since 2023. Proofpoint's 2026-07-23 report is the first to consolidate the current actor (which it tracks as TA458) as running a standing supply of such zero-days across five distinct webmail products at once, and to disclose a previously-unknown SOGo flaw within it.
TA458 runs "half-click" exploits: the target "must only open the malicious email in their webmail viewer to be compromised" — no link, attachment, or click (Proofpoint, 2026-07-23). The mechanism is an event-handler injection into content the webmail client fails to sanitize, executing attacker JavaScript in the victim's authenticated session the moment the message renders. The active set spans Zimbra (CVE-2025-27915), mDaemon (CVE-2025-3929), Roundcube (n-day CVE-2023-43770 and CVE-2024-42009), Kerio Connect (a flaw found March 2026, no CVE assigned to the end-of-life product), and — newly disclosed — SOGo, where Proofpoint "reported to the vendor, Alinto; it was patched as CVE-2026-8496 in version 5.12.8" (Proofpoint, 2026-07-23). Each intrusion drops SpyPress, a per-client-customized obfuscated JavaScript payload whose consistent objective across variants is "theft of credentials, contacts, and emails."
On Roundcube targets the operation has shifted from smash-and-grab theft to durable access: SpyPress chains a second Roundcube flaw (CVE-2025-49113) that abuses the file-upload handler to trigger unsafe PHP deserialization, using the mail server's own GPG engine as a deserialization gadget to execute code, then plants PHP webshells inside Roundcube's program and plugin directories and multiple reverse-shell fallbacks (Proofpoint, 2026-07-23). Targeting concentrates on Ukrainian government and Eastern-European military and government entities across Albania, Greece, Moldova and Türkiye, with occasional chemical, telecom and technology victims. Proofpoint "assesses that TA458 is likely a Russian military intelligence operation directed by the Russian GRU" and reports no telemetry overlap between TA458 and TA422 (APT28/Sofacy) — a distinct GRU cluster — with the specific unit unconfirmed. Attribution here is not settled across vendors: ESET's original Operation RoundPress reporting associated the activity with Sednit (APT28), so the TA458 and RoundPress labels should be treated as overlapping tracking rather than a single confirmed actor.
A 'half-click exploit' requires no social engineering, nor does it require a user to click a link or open an attachment. The targeted user must only open the malicious email in their webmail viewer to be compromised.
SOGo webmail platform, which we reported to the vendor, Alinto; it was patched as CVE-2026-8496 in version 5.12.8
Proofpoint assesses that TA458 is likely a Russian military intelligence operation directed by the Russian GRU.
Defender actions
- Patch every self-hosted SOGo instance to 5.12.8 now — CVE-2026-8496 is a webmail zero-day being used by TA458 to fire on message-open with no user interaction.
- Inventory internet-reachable self-hosted Zimbra, mDaemon, Roundcube, Kerio and SOGo webmail and prioritise those instances for patching — with a half-click exploit, an exposed unpatched webmail server equals mailbox-compromise-on-view.
ATT&CK mapping
6 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
T1566Phishing
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Execution TA0002
T1203Exploitation for Client Execution
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Persistence TA0003
T1505.003Server Software Component: Web Shell
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
Credential Access TA0006
T1539Steal Web Session Cookie
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
Collection TA0009
T1114.002Email Collection: Remote Email Collection
Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.