SpyPress: JavaScript Malware Used in Operation RoundPress
SpyPress is an obfuscated JavaScript-based malware used by TA458 in Operation RoundPress. It targets webmail platforms including Roundcube, Zimbra, Kerio, SOGo, and…
Tag: webmail
CVE-2026-8496: Zero-Day in SOGo Webmail Exploited by TA458
CVE-2026-8496 is a zero-day vulnerability in the SOGo webmail platform exploited by TA458 in March 2026. It was patched in version 5.12.8.
TA458: Russian Military Intelligence Operation Targeting Webmail
TA458 is a threat actor tracked by Proofpoint, likely a Russian military intelligence operation. It conducts Operation RoundPress using half-click XSS exploits…