Russian Hackers Target Email Servers Using XSS Vulnerabilities to Deploy Malicious Code

A recently uncovered cyberespionage campaign, tracked as Operation RoundPress, has exposed the persistent and evolving threat posed by the Russian-linked APT group Sednit (also known as APT28, Fancy Bear, or Sofacy), believed to be closely associated with Russia’s GRU.

The campaign demonstrates advanced exploitation of cross-site scripting (XSS) vulnerabilities in widely used webmail servers-Roundcube, Horde, MDaemon, and Zimbra-to deploy custom JavaScript malware for intelligence gathering on high-value government and defense-related targets.

Operation RoundPress was first identified in 2023 with attacks exploiting CVE-2020-35730 in Roundcube, but in 2024 expanded aggressively to leverage additional vulnerabilities, including a zero-day (CVE-2024-11182) affecting MDaemon webmail.

The threat actors initiate attacks via spearphishing emails crafted to embed XSS exploits, which, when viewed in a vulnerable webmail client, execute malicious JavaScript payloads in the user’s browser session.

This approach enables theft of credentials, email content, contacts, and even circumvention of two-factor authentication mechanisms.

ESET researchers attribute the campaign to Sednit with medium confidence, citing unique infrastructure overlaps, phishing methodologies, and payload code similarities with other documented Sednit operations.

Analysis shows that RoundPress has primarily targeted Eastern European governmental entities and defense companies involved in the Ukraine war, but incidents have also been recorded in Africa, South America, and EU member states.

Technical Anatomy of the Attack

Through the operation, Sednit deployed four primary JavaScript payloads-SpyPress.HORDE, SpyPress.MDAEMON, SpyPress.ROUNDCUBE, and SpyPress.ZIMBRA.

Each variant is tailored for its specific webmail platform and is heavily obfuscated, with encrypted configuration strings and randomized code structures to evade detection.

Upon successful XSS exploitation, the injected JavaScript executes a series of actions:

• Credential harvesting by manipulating login forms and in some cases triggering fake login screens.
• Automated collection and exfiltration of emails, address books, and account configurations.
• Establishment of persistence through email forwarding rules (notably via Sieve scripts in Roundcube).
• In the case of MDaemon, extraction of two-factor authentication secrets and creation of “app passwords” to bypass MFA controls.

All exfiltrated data is sent via HTTPS POST requests to attacker-controlled command and control (C2) servers.

The campaign’s infrastructure demonstrates overlap in C2 domains and IPs across payload variants, underscoring centralized operational management.

Exploit Details and Impact

The technical sophistication of the operation is evidenced by Sednit’s success in weaponizing a zero-day (CVE-2024-11182) before its patching and exploiting known flaws in major platforms:

• Roundcube: Unpatched instances are compromised using XSS flaws in email message rendering, allowing attackers to insert script tags directly.
• MDaemon: Exploited a parsing bug permitting arbitrary HTML/JavaScript execution.
• Zimbra: Leveraged improper sanitization of calendar invitation headers to execute JavaScript.
• Horde: Attempted exploitation of legacy XSS flaws, though some attack attempts appear misconfigured.

The campaign’s impact is significant: in 2024 alone, numerous attacks were logged against national governments, defense contractors, and state agencies across Bulgaria, Ukraine, Romania, Cameroon, Ecuador, Cyprus, Serbia, and more.

The extraction of confidential communications and credentials poses severe operational security risks, particularly for organizations engaged in defense and geopolitical affairs.

Operation RoundPress exemplifies the criticality of timely webmail server patching and underscores the value of layered email security and behavioral monitoring.

The adaptability and technical proficiency of Sednit, from rapid adoption of zero-days to sophisticated credential theft and data exfiltration routines, highlight the persistent threat landscape faced by public-sector and defense organizations globally.

Security teams are urged to review the following Indicators of Compromise (IoCs), update webmail platforms, and monitor for anomalous server communications.

Indicators of Compromise (IoCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates