Operation RoundPress: APT28’s Webmail Espionage Exposed

In Operation RoundPress, Russian state-backed hackers known as APT28 carried out a stealthy webmail espionage campaign by exploiting known vulnerabilities in popular email platforms like Roundcube, Horde, and Zimbra. The attackers sent specially crafted emails containing malicious JavaScript code that executed as soon as the email was opened-no clicks needed. This allowed them to silently steal session tokens, email content, and other sensitive data, which was then exfiltrated to their remote servers. Their targets included high-profile entities. The attackers kept a low profile by using lightweight scripts and frequently rotating domains to evade detection. This operation highlights how dangerous unpatched webmail systems can be; even a single overlooked update can open the door to nation-state espionage.