TA458 Uses Half-Click Webmail Exploits to Steal Email and Establish Persistent Access

Jul 15, 2026 · Original article ↗

Summary

Proofpoint details TA458’s use of half-click exploits against webmail platforms to steal credentials, contacts, and emails. SpyPress can also establish persistent access on Roundcube, while a SOGo zero-day was patched as CVE-2026-8496.

Key points

TA458 sends exploit-laden emails; a target can be compromised simply by opening the message in a webmail viewer, without clicking a link or opening an attachment.
Targets include Ukrainian government entities and military and government organizations in Eastern Europe, with occasional targeting of chemical, telecommunications, and technology firms.
The group has exploited webmail platforms including Zimbra, mDaemon, Roundcube, Kerio, and SOGo. Proofpoint reported a SOGo zero-day to Alinto; it was patched in version 5.12.8 as CVE-2026-8496.
SpyPress, an obfuscated JavaScript-based malware, can steal credentials, contacts, and emails; its capabilities vary by target webmail platform.
On Roundcube, SpyPress uses CVE-2025-49113 to pursue long-term access, attempting multiple persistence methods, including reverse shells and webshells.
Proofpoint assesses TA458 is likely aligned with Russia’s GRU, but says it lacks evidence to substantiate a possible link to a specific GRU unit.

Article Details

Attack Vectors: TA458 sends exploit-laden emails from actor-controlled or compromised accounts; opening the message in a webmail viewer can trigger a half-click exploit without a link click or attachment opening.
The exploits target insufficiently sanitized webmail features to execute arbitrary JavaScript, including in Kerio, SOGo, Zimbra, mDaemon, and Roundcube.
On Roundcube targets, SpyPress exploits unsafe PHP deserialization through the file upload handler to execute code and attempt persistence using reverse shells, fetched content, and dropped PHP webshells.
Defensive Notes: Patch affected webmail products; the article reports that SOGo patched CVE-2026-8496 in version 5.12.8.
Proofpoint says it followed responsible disclosure practices and alerted vendors when it observed new exploits.
The article lists ET rules for SpyPress C2 activity, dropped webshell requests, and exploits affecting SOGo, Zimbra, mDaemon, and Roundcube.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`hgmydr[.]wiki`	Listed in the article's SpyPress C&C indicator section.
DOMAIN	`upgybj[.]store`	Listed in the article's SpyPress C&C indicator section.
DOMAIN	`xsza[.]net`	Listed in the article's SpyPress C&C indicator section.
DOMAIN	`xwe[.]us`	Listed in the article's SpyPress C&C indicator section.
DOMAIN	`zxzaq[.]com`	Listed in the article's SpyPress C&C indicator section.
SHA256	`3a449148a0e3cac604fb93210dd7d91ccf48e06ed9aae064bc53a419a84ce9ba`	Hash of an exploit-laden email identified in the indicator table.
SHA256	`625e4c166c7a1d5a1becf56b27d4f76a2f95935cbd8d556c30a493263d10dbf8`	Hash of an exploit-laden email identified in the indicator table.
SHA256	`6b2c02bf82087a3ca5fb7ef8046554ff29ce85d52202bdcfae2b2653aede139a`	Hash listed among the article's exploit-laden email indicators.
SHA256	`8b5a4dc237a4c89042176bc89864a4c357dcdd14fa544fe6496ccb6c31cd5b7f`	Hash of an exploit-laden email identified in the indicator table.
SHA256	`a0c80cab70d6672b01710a70f93311fc1c1db2fbbf9cd6daa543c34b87e3444a`	Hash of an exploit-laden email identified in the indicator table.
SHA256	`e27d1bf82249002a66395c89dbda6ec5d8df012a84b79d36fffbbf7808d28878`	Hash of an exploit-laden email identified in the indicator table.
SHA256	`fb8ec4dbed14c0a91361abd82ebe9fb083615c3dbb15348f57317af7cc41dd34`	Hash listed among the article's exploit-laden email indicators.