Blab Tech
Russian Espionage Group TA458 Continues Half-Click Exploit Campaign Against Government Webmail Servers
In March 2026, Russian‑aligned threat actor TA458 exploited a zero‑day flaw in the SOGo webmail platform, prompting Alinto to issue a security patch. The group, linked to the General Staff Main Intelligence Directorate (GRU), has repeatedly used “half‑click” cross‑site scripting (XSS) attacks to compromise government and military email accounts without the victim needing to click a link or open an attachment.
Half‑click exploits differ from traditional phishing because the target only opens a malicious email in a webmail interface. The attacker injects JavaScript that runs automatically when the email is displayed, allowing the adversary to harvest credentials, contacts, and email contents. Proofpoint’s analysis shows that TA458’s attacks rely on a supply‑chain of XSS vulnerabilities in popular webmail systems, including Zimbra, mDaemon, Roundcube, Kerio, and SOGo.
The most recent campaign, detailed in Proofpoint’s second‑part blog, involved CVE‑2026‑8496 in SOGo. The flaw lets an attacker execute arbitrary JavaScript through a maliciously crafted iCalendar file. Proofpoint reported the exploit to Alinto, which released version 5.12.8 to fix the issue. The group has also leveraged other zero‑day and known‑day vulnerabilities: CVE‑2025‑27915 in Zimbra, CVE‑2025‑3929 in mDaemon, CVE‑2023‑43770 and CVE‑2024‑42009 in Roundcube, and CVE‑2025‑49113 for a Roundcube file‑upload deserialization flaw.
Payloads are delivered via compromised or actor‑controlled email accounts. In some cases, proxy services act as jump boxes to forward malicious messages. The emails themselves contain no visible indicators of compromise; the malicious code is embedded in the email body or attachments that the webmail client renders. Proofpoint has not seen evidence that previously targeted mailservers are used to forward the exploit to new victims, suggesting that TA458 obtains sending addresses through other means.
A core component of TA458’s toolkit is the SpyPress malware, a JavaScript‑based payload obfuscated with the Obfuscator IO tool. SpyPress is tailored to the specific webmail platform it infects, but its core functions—credential theft and persistence—remain consistent. In July 2025, the group updated SpyPress to include long‑term access mechanisms for Roundcube, exploiting CVE‑2025‑49113, a deserialization flaw that allows execution of arbitrary code via the Crypt_GPG_Engine gadget. Once the code runs, SpyPress installs one of six persistence methods, ranging from reverse shells to PHP webshells dropped in various Roundcube directories.
Proofpoint’s attribution analysis indicates that TA458 is likely a GRU unit, possibly Unit 20728, based on shared tactics, techniques, and procedures with other GRU‑linked groups. The group’s primary targets are Ukrainian government and military entities, with additional attacks against entities in Albania, Greece, Moldova, and Türkiye. Outliers include chemical, telecommunications, and technology firms. The lack of reconnaissance in some campaigns suggests that TA458 may be opportunistic, exploiting any vulnerable webmail platform it encounters.
The cybersecurity community has noted that the rise of large language models could accelerate the discovery of new XSS vectors, but vendors are increasingly patching known weaknesses. As webmail providers reduce exploitable surface area, TA458 may shift to less common mail platforms or to direct mailbox compromise once the half‑click vector is closed.
All identified vulnerabilities have been patched by their respective vendors. Proofpoint continues to monitor for new exploit activity and to alert affected organizations. The situation underscores the need for timely application of security updates and for email clients to sanitize user‑supplied content rigorously.
Half‑click exploits differ from traditional phishing because the target only opens a malicious email in a webmail interface. The attacker injects JavaScript that runs automatically when the email is displayed, allowing the adversary to harvest credentials, contacts, and email contents. Proofpoint’s analysis shows that TA458’s attacks rely on a supply‑chain of XSS vulnerabilities in popular webmail systems, including Zimbra, mDaemon, Roundcube, Kerio, and SOGo.
The most recent campaign, detailed in Proofpoint’s second‑part blog, involved CVE‑2026‑8496 in SOGo. The flaw lets an attacker execute arbitrary JavaScript through a maliciously crafted iCalendar file. Proofpoint reported the exploit to Alinto, which released version 5.12.8 to fix the issue. The group has also leveraged other zero‑day and known‑day vulnerabilities: CVE‑2025‑27915 in Zimbra, CVE‑2025‑3929 in mDaemon, CVE‑2023‑43770 and CVE‑2024‑42009 in Roundcube, and CVE‑2025‑49113 for a Roundcube file‑upload deserialization flaw.
Payloads are delivered via compromised or actor‑controlled email accounts. In some cases, proxy services act as jump boxes to forward malicious messages. The emails themselves contain no visible indicators of compromise; the malicious code is embedded in the email body or attachments that the webmail client renders. Proofpoint has not seen evidence that previously targeted mailservers are used to forward the exploit to new victims, suggesting that TA458 obtains sending addresses through other means.
A core component of TA458’s toolkit is the SpyPress malware, a JavaScript‑based payload obfuscated with the Obfuscator IO tool. SpyPress is tailored to the specific webmail platform it infects, but its core functions—credential theft and persistence—remain consistent. In July 2025, the group updated SpyPress to include long‑term access mechanisms for Roundcube, exploiting CVE‑2025‑49113, a deserialization flaw that allows execution of arbitrary code via the Crypt_GPG_Engine gadget. Once the code runs, SpyPress installs one of six persistence methods, ranging from reverse shells to PHP webshells dropped in various Roundcube directories.
Proofpoint’s attribution analysis indicates that TA458 is likely a GRU unit, possibly Unit 20728, based on shared tactics, techniques, and procedures with other GRU‑linked groups. The group’s primary targets are Ukrainian government and military entities, with additional attacks against entities in Albania, Greece, Moldova, and Türkiye. Outliers include chemical, telecommunications, and technology firms. The lack of reconnaissance in some campaigns suggests that TA458 may be opportunistic, exploiting any vulnerable webmail platform it encounters.
The cybersecurity community has noted that the rise of large language models could accelerate the discovery of new XSS vectors, but vendors are increasingly patching known weaknesses. As webmail providers reduce exploitable surface area, TA458 may shift to less common mail platforms or to direct mailbox compromise once the half‑click vector is closed.
All identified vulnerabilities have been patched by their respective vendors. Proofpoint continues to monitor for new exploit activity and to alert affected organizations. The situation underscores the need for timely application of security updates and for email clients to sanitize user‑supplied content rigorously.
