Do Son 
At a Glance
| Actor or group | TA488 (Void Blizzard, Laundry Bear) and TA458 (Operation RoundPress), both Russia-aligned |
| Activity type | Espionage via cross-site scripting flaws in webmail; credential and email theft |
| Targets | Ukrainian government, US defense industrial base and nuclear installations, and government bodies across Eastern Europe |
| Scale | At least five months of undetected Zimbra exploitation; no victim count published |
| Law-enforcement status | Released with NSA and FBI advisories; US federal indictments allege a contractor relationship, with no verdict reported |
| Source | Proofpoint Threat Research, two-part series |
TL;DR
Proofpoint published two reports on Russia-aligned groups that hunt webmail servers. TA488 exploited an unknown Zimbra flaw for at least five months in 2025 before it became CVE-2025-66376. TA458 keeps finding fresh webmail zero-days, most recently in SOGo.
What Happened
Both groups rely on the same delivery trick. They send an ordinary-looking email, and the victim never clicks anything.
How a Half-Click Exploit Works
Researchers describe the class plainly: “opening the email is enough to allow the exploit to trigger.” No link, no attachment, no social engineering.
The mechanism sits in the webmail client’s HTML sanitizer. TA488 hid an executable tag inside a hidden container, then split it apart with fake CSS import directives and comments. The sanitizer failed to see anything dangerous. The browser, however, stitched the fragments back into a working event handler and ran the attacker’s JavaScript.
That code runs inside the authenticated session. It also runs in the browser’s JavaScript engine, so endpoint tools rarely leave a useful forensic trail.
ZimReaper Empties the Mailbox
Proofpoint tracks TA488’s payload as ZimReaper. After firing, it steals the session’s CSRF token and the auto-complete password, then queries Zimbra’s own APIs for reconnaissance and two-factor codes.
Persistence is the clever part. ZimReaper creates an app-specific password named to look like a normal web client. That credential grants IMAP, POP3, and SMTP access without any two-factor prompt.
Collection follows. The script walks the global address list, then exports 90 days of mail as an archive and uploads it. Smaller secrets leave over DNS queries instead. TA488 then used compromised mailboxes to send the next round of exploit emails, which made those lures look legitimate.
TA458 Goes for Long-Term Access
TA458 runs the operation ESET named RoundPress. Its SpyPress malware adapts to whichever platform it lands on. Observed targets now span Zimbra (CVE-2025-27915), mDaemon (CVE-2025-3929), Roundcube (CVE-2024-42009, CVE-2023-43770), Kerio, and SOGo (CVE-2026- 8496).
On Roundcube, the group changed strategy. It chained a second flaw, CVE-2025-49113, to reach unsafe deserialization and arbitrary code execution. SpyPress then tries six fallback persistence methods, including reverse shells and dropped webshells, so at least one survives.
Who Is Behind It
Attribution differs sharply between the two groups, and the difference matters.
For TA488, Proofpoint could not reach high confidence from its own telemetry alone. Work with US government partners confirmed the link to Void Blizzard. US federal indictments allege that TA488 operates as a private contractor for Russian intelligence. Those are charges, not convictions, and no verdict has been reported.
TA458 sits lower on the confidence scale. Proofpoint assesses it as likely GRU-directed. A possible tie to a specific GRU unit named in French government material remains an unsubstantiated hypothesis, which the researchers say they cannot support with current data.
Impact and Scale
No victim numbers exist, and no money is involved. Dwell time tells the story instead. TA488 ran against Zimbra for at least five months before the flaw was patched.
Targeting explains the interest. Proofpoint lists Ukrainian government bodies, US nuclear installations, and defense contractors for TA488. TA458 focuses on Ukraine plus government and military entities in Albania, Greece, Moldova, and Türkiye. Full detail sits in Proofpoint’s reports on TA488’s half-click exploits against Zimbra and on TA458’s webmail zero-days.
What Comes Next
TA488 went quiet after February 2026 and tore down its infrastructure once researchers published. TA458 did the opposite. Proofpoint notes that “TA458 has been undeterred by repeated exposure from industry and government releases.”
- Patch webmail appliances promptly, especially Zimbra, Roundcube, and SOGo.
- Audit app-specific passwords and API tokens, since they bypass two-factor authentication.
- Monitor outbound DNS from mail servers for high-volume lookups to unfamiliar domains.
- Review mail export and bulk-download activity in webmail audit logs.
- Treat domains that mimic mail telemetry services as suspicious, not routine.
Researchers also expect language models to speed up bug discovery in the short term. Over time, though, the same tooling should help vendors close these gaps.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
