TA458

TA458 is a Russia-aligned espionage threat actor associated with Operation RoundPress and assessed as likely linked to the Russian GRU, although attribution to a specific GRU unit remains unsubstantiated. The group specializes in webmail exploitation and has repeatedly used so-called half-click attacks in which a victim is compromised simply by opening a malicious email in a webmail client, without needing to click a link or open an attachment. TA458 has targeted multiple webmail platforms, including Zimbra, Roundcube, mDaemon, Kerio, and SOGo, and has exploited both zero-day and n-day vulnerabilities to gain access to sensitive communications. TA458 primarily targets Ukrainian government entities and military and government organizations across Eastern Europe. Reported targeting also includes entities in Albania, Greece, Moldova, and Türkiye, with occasional activity against chemical, telecommunications, and technology organizations. The actor’s operations are consistent with intelligence collection, particularly theft of sensitive email content, credentials, contacts, and related communications data. A core malware component used by TA458 is SpyPress, a JavaScript-based capability adapted to the specific webmail platform under attack. SpyPress has been used to steal credentials, contacts, and emails, and in some cases has been modified beyond collection functions to support longer-term access. In Roundcube-focused activity, TA458 was observed chaining client-side exploitation with server-side deserialization leading to arbitrary code execution, then attempting multiple fallback persistence mechanisms including webshell-style access and remote command retrieval methods. The actor also uses actor-controlled and compromised accounts to distribute exploit emails and has employed proxy infrastructure to support operations. Known aliases and associated naming include Operation RoundPress as the campaign name; no broadly established alternate public group name beyond TA458 is directly supported here.