The Half-Click — Operation RoundPress and the Attack That Needs No Victim

Section 01

Executive Summary

In March 2026, I published an analysis of how Russian intelligence bypassed Signal and WhatsApp without breaking their encryption. The attack required something from the victim — a response, a code, a moment of trust misplaced. The human was the vulnerability. I called it the encryption illusion: perfect technology, exploited through imperfect people.

This is the next chapter. And it is worse.

On July 23, 2026, Proofpoint published a joint disclosure with the NSA and FBI documenting two Russian-aligned threat actors — TA458 (Operation RoundPress) and TA488 (Void Blizzard) — running active campaigns against government webmail servers using what researchers are calling half-click exploits. The name tells you everything. You do not need to click a link. You do not need to open an attachment. You do not need to respond to anything. You open the email. That is all. The attack is already over.

The targets are not random. Ukrainian government ministries. US nuclear installations. NATO member governments in Albania, Greece, Moldova, and Turkey. Eastern European defense industrial base companies. The organizations that chose to self-host their email specifically because they did not trust commercial cloud providers with sensitive communications. The very decision intended to protect them became the attack surface.

Months Undetected

TA488 operated against Zimbra servers from July 2025 before discovery. Source: Proofpoint, July 2026.

Days of Email Stolen

ZimReaper exfiltrated the last 90 days of inbox content from every compromised account.

Platforms
Targeted

Zimbra, Roundcube, mDaemon, SOGo, Kerio, Horde. Each exploited with a dedicated zero-day.

User Actions Required

Opening the email in a vulnerable webmail client is sufficient. No click, no download, no interaction.

Section 02

The Sovereignty Trap — Why the Victims Chose the Vulnerable System

To understand why this attack is so damaging, you have to understand why the targets were running Zimbra and Roundcube in the first place. This is not a story about careless organizations making obvious mistakes. It is a story about organizations making a reasonable security decision that Russian intelligence turned into a kill zone.

Zimbra and Roundcube are open-source, self-hosted webmail platforms. An organization installs them on its own servers, in its own data center, under its own control. No third party has access to the email. No foreign company holds the encryption keys. No US subpoena can reach the server. For a Ukrainian government ministry, a small NATO-member defense contractor, or an Eastern European university handling sensitive research, this is not paranoia — it is exactly the kind of infrastructure sovereignty that responsible governments are supposed to maintain.

The irony is almost too precise. The organizations most committed to keeping their communications off commercial cloud servers, most careful about foreign access to their data, most deliberate about infrastructure independence — are the exact organizations running the platforms with the widest known attack surface and the least internal capacity to patch them.

Analyst note: Good intentions are not a defense posture. The decision to self-host email for sovereignty reasons is sound. The failure is what comes after: treating the infrastructure as "set it and forget it" because the threat model was foreign interception, not foreign exploitation. TA458 and TA488 understood this gap. The targeting was not accidental.

Figure 1 — Operation RoundPress: Escalation Timeline 2023–2026

2023 — Initial Operations

TA458 Targets Roundcube — Ukraine Focus

APT28-linked actor begins exploiting known XSS vulnerability CVE-2020-35730 in Roundcube webmail. Targets are Ukrainian military personnel and government agencies. CERT-UA and Recorded Future document the campaign. The technique is not new — but the scale and deliberateness of the targeting signals a strategic priority, not opportunistic scanning.

2024 — Platform Expansion

TA458 Adds Horde, mDaemon, Zimbra — First Zero-Day

TA458 expands beyond Roundcube. A zero-day vulnerability in MDaemon Email Server (CVE-2024-11182) is discovered and exploited before the vendor knows it exists. ESET researchers catch it, report it, and it is patched in 14 days — but not before Ukrainian defense companies are compromised. The SpyPress JavaScript malware family is deployed across all four platforms, customized per target.

July 2025 — New Actor Enters

TA488 (Void Blizzard) Begins Zimbra Zero-Day Campaign

A second Russian-aligned actor — TA488, a private contractor working for Russian intelligence per US federal indictments — begins exploiting CVE-2025-66376, an unknown Zimbra vulnerability. Targets include Ukrainian government entities and US nuclear installations. The campaign runs for five months before detection. ZimReaper malware exfiltrates credentials, 2FA codes, and 90 days of email from each victim via DNS tunneling.

Early 2026 — Further Expansion

TA458 Adds SOGo and Kerio — Shift to Long-Term Access

TA458 discovers and exploits zero-days in SOGo webmail (CVE-2026-8496) and the legacy Kerio platform. On Roundcube targets, SpyPress evolves — shifting from credential theft to persistent backdoor installation, including a PHP webshell and six fallback persistence mechanisms. The actor is no longer just reading email. They are establishing long-term footholds inside the server itself.

July 23, 2026 — Public Disclosure

NSA, FBI, and Proofpoint Publish Joint Advisory

Coordinated disclosure burns the operations publicly. The NSA and FBI issuing a joint advisory means the intelligence community decided warning defenders was more important than preserving continued observation of the campaigns. That decision is itself a signal about severity.

Sources: Proofpoint Threat Insight (July 23, 2026), ESET Research, CERT-UA, NSA/FBI Joint Advisory CSA_RUSSIA_PHISHING_TARGET_ZIMBRA

Section 03

How It Works — The Attack That Needs No Victim

In the Signal campaign I analyzed earlier this year, Russia needed the victim to do something. Respond to a message. Share a verification code. Scan a QR code. The human was the vulnerability — and humans can be trained, warned, made suspicious.

Operation RoundPress removed that requirement entirely. The attack I am describing here does not need you to click anything, download anything, or respond to anything. It needs you to open an email. The exploit is embedded in the HTML of the message itself. The moment your vulnerable webmail client renders it, malicious JavaScript executes silently in the background — inheriting your authenticated session, your permissions, your mailbox access.

The technique is called a half-click exploit. Not zero-click, because you did technically open the email. But the threshold between "doing nothing" and "being compromised" has collapsed to the smallest possible human action — one that is automatic, routine, and completely indistinguishable from reading any other email.

The obfuscation technique explained: TA458 and TA488 hide the exploit by fragmenting HTML tags with fake CSS @import directives. The sanitizer reads scr@import;ipt and strips the @import sequence — leaving script. The browser reassembles the fragments into valid executable markup. What looks like corrupted gibberish to a security filter is a perfectly structured exploit to a browser renderer.

Figure 2 — ZimReaper Attack Chain (TA488 / CVE-2025-66376)

Delivery — The Email Arrives

TA488 sends an email from either an adversary-controlled Proton Mail account or a previously compromised legitimate sender account. The content is generic — a cooperation proposal, a meeting request, a news item. The subject line is unremarkable. Nothing about the email flags as suspicious because nothing about it needs to be suspicious. The payload is in the HTML.

Rendering — The Victim Opens the Email

The victim opens the email in their Zimbra webmail client — a browser tab running the authenticated session. Zimbra's HTML sanitizer attempts to strip dangerous markup, but the @import tag-splitting obfuscation causes it to miss the payload. The browser reconstructs the fragmented tags and executes the JavaScript. This happens in milliseconds. The victim is still reading the first sentence.

Credential Harvest — ZimReaper Takes What It Came For

The JavaScript payload — tracked by Proofpoint as ZimReaper — runs inside the authenticated browser session. It steals the CSRF token, the auto-complete password stored by the browser, and any available 2FA scratch codes. All of this is exfiltrated immediately via DNS queries encoded in Base32 to attacker-controlled domains spoofing Zimbra telemetry services. The exfiltration looks like normal DNS traffic.

Persistent Access — The Back Door Is Installed

ZimReaper calls Zimbra's own CreateAppSpecificPasswordRequest API to generate a password named "ZimbraWeb" — a credential that allows IMAP, POP3, or SMTP access without requiring two-factor authentication. The victim's account now has a permanent back door that survives password changes. The attacker can read email, send email as the victim, and use the compromised account to send exploit-laden messages to the next target.

Exfiltration — The Last 90 Days Leave the Building

ZimReaper iterates through the last 90 days of email accessible to the compromised user and uses Zimbra's export API to send the full archive to the attacker's C2 server in a TGZ file via HTTP POST. It also walks the Zimbra Global Address List using every possible two-character combination — mapping the entire organization's contact directory. For a Ukrainian defense ministry official, 90 days of email during an active war is an intelligence gold mine.

Based on Proofpoint's July 23, 2026 technical analysis of TA488 ZimReaper campaigns targeting CVE-2025-66376. MITRE ATT&CK: T1566.001 (Spearphishing Attachment), T1059.007 (JavaScript), T1539 (Steal Web Session Cookie), T1048 (Exfiltration Over Alternative Protocol)

check_circle What Looks Normal

The sender: A Proton Mail address or a known colleague's account — TA488 used compromised accounts to add legitimacy to subsequent waves.

The email: A cooperation proposal from a Belgian foundation. A meeting request. A news summary. Generic, professional, unremarkable.

The DNS traffic: Queries to domains that look like Zimbra telemetry services. Hosted on Cloudflare. Indistinguishable from normal infrastructure traffic.

The API calls: Zimbra's own APIs, called with the user's own session token. A security log shows a user exporting their own mail.

warning What Is Actually Happening

The sender: A Russian intelligence contractor with a federal indictment, or an actor who already owns someone else's account.

The email: An exploit delivery vehicle. The content is irrelevant — it just needs to be opened.

The DNS traffic: Base32-encoded credentials, 2FA codes, and session tokens leaving the organization silently in DNS query subdomains.

The API calls: An attacker using the victim's session to install a permanent backdoor and steal 90 days of classified communications.

Section 04

Key Findings

The Patch Gap Is the Attack Surface

CVE-2025-66376 was exploited for at least five months before it was patched. But the vulnerability gap is structural, not situational. Zimbra, Roundcube, mDaemon, SOGo, and Kerio are self-hosted platforms deployed by organizations without dedicated security teams. When a patch is released, someone has to notice it, test it, schedule a maintenance window, and apply it. For a Ukrainian ministry IT team managing dozens of systems during wartime, that process can take months. TA458 has been exploiting this operational reality since 2023 — moving from one webmail platform to the next as patches close individual CVEs, because the patch gap is always there.

CRITICAL

The Sophistication Gap Is Deliberate Targeting

The organizations running Zimbra and Roundcube are not the organizations with CrowdStrike, a 24/7 SOC, and behavioral anomaly detection on DNS. They are the organizations that chose open-source self-hosted infrastructure because it was free, sovereign, and under their control. TA458 and TA488 are not stumbling across these targets — they are specifically hunting for webmail platforms that are widely deployed in resource-constrained government environments and have historically slow patch cycles. The attack is calibrated to operate below the detection threshold of exactly the defenders most likely to be running the targeted software.

CRITICAL

The Attack Bypasses Every Post-Delivery Defense

Traditional email security tools — spam filters, antivirus, attachment scanning — operate on the envelope and attachments of an email. A half-click XSS exploit lives in the HTML body of a message that contains no malicious attachment, no known-bad URL, no suspicious sender, and no file to scan. Once the email reaches the inbox and the victim opens it in a vulnerable webmail client, every post-delivery defense is bypassed by design. SIEM, EDR, and UEBA tools can theoretically detect anomalous behavior after the fact — unusual API calls, DNS exfiltration patterns — but only if those specific behaviors are already being monitored, and only after the credentials are already stolen. The only clean detection window is before delivery.

CRITICAL

Compromised Accounts Become Weapons Against New Targets

Both TA458 and TA488 used compromised sender accounts to deliver exploit emails to subsequent targets. A Ukrainian government official receiving an exploit email from a known colleague's address has no technical signal to distinguish it from a legitimate message. The trust network of the first victim becomes the attack infrastructure for the next wave. This is why the NSA and FBI coordinated on public disclosure — burning the operation was worth more than continued intelligence collection because the campaign was actively spreading through trusted government communication channels.

HIGH

The Exploit Supply Chain Suggests Intelligence Coordination

Proofpoint notes that TA458 has access to a consistent supply of webmail zero-days — more than a single research team could realistically develop. The working hypothesis is that these exploits are either developed by a GRU-adjacent team and distributed down to operational actors, or procured from a third party. The fact that TA488 used CVE-2025-66376 while TA458 did not — despite TA458's established access to Zimbra exploits — suggests deliberate deconfliction between operations, which implies coordination at a level above individual threat actor groups. Private contractors working for Russian intelligence, as US federal indictments confirm for TA488, operating within a structured intelligence tasking framework.

HIGH

Section 05

What to Do — and What the Advice Has to Acknowledge

The standard security recommendation at this point would be: patch your systems, enable MFA, monitor your logs. That advice is correct. It is also insufficient when the audience is a Ukrainian government ministry with three IT staff managing wartime infrastructure, or a small Eastern European defense contractor that has been running Zimbra since 2015 and considers it stable.

The realistic defense posture depends on where you are in the resource spectrum. Here is what actually applies at each level.

Migrate Off Self-Hosted Webmail Where Possible

The most effective mitigation is not a patch — it is moving to a hosted platform where someone else manages the security update cycle. Gmail, Microsoft 365, and Proton Mail for Business all provide automatic security updates. For organizations with sovereignty concerns about US platforms, European-hosted alternatives with strong update practices are a better risk tradeoff than a self-hosted server that will not be patched for months after a CVE drops. The sovereignty argument for self-hosting only holds if the self-hosted system is actually secure — an unpatched Zimbra server in your own data center is less secure than a well-managed hosted service.

If You Run Zimbra — Audit for ZimReaper Now

Proofpoint's remediation guidance is specific: review /opt/zimbra/log/audit.log for calls to CreateAppSpecificPassword and look for any entry named "ZimbraWeb." If you find one, the account was compromised. The app-specific password provides persistent access that survives password changes — you must revoke it explicitly, not just reset the user's main password. Also review the last 90 days of your email export API calls for anomalous bulk export activity.

Block the Known C2 Infrastructure

Proofpoint published the full list of ZimReaper C2 domains, all spoofing Zimbra telemetry services. Block them at your DNS resolver and firewall. Also block the known TA458 SpyPress C2 domains. These indicators are current as of July 2026 — the actors burned their infrastructure after the Seqrite disclosure in February, but the IOCs are still valid for retrospective investigation and pattern awareness.

Add an Email Security Layer Before the Webmail Client

The only clean detection window in this attack chain is before the email reaches the inbox. Email security platforms that sit in the mail flow — analyzing the HTML body of messages before delivery — can detect the @import tag-splitting obfuscation pattern, the svg onload=eval(atob( structure, and known exploit signatures before any webmail client renders them. For organizations that cannot or will not migrate off self-hosted webmail, this is the single highest-leverage mitigation available. Sublime Security's existing rule body_cve_2023_5631.yml already catches one specific Roundcube exploit using this approach. The pattern generalizes.

Treat Safe Advice Carefully in Vulnerable Environments

Standard advice — "view the raw source of suspicious emails to check for malicious HTML" — is dangerous if the person asking is running a vulnerable unpatched Zimbra client. Opening the email to view source triggers the attack. The only safe action in that environment is not opening the email at all until the webmail server is patched. Advise accordingly: patch first, investigate second.

Known IOCs — ZimReaper and SpyPress (July 2026)

All domains defanged. Source: Proofpoint Threat Insight, July 23, 2026.

Indicator	Type	Actor	First Seen
zmailanalytics[.]com	C2 Domain	TA488 ZimReaper	July 2025
zimbra-metadata[.]com	C2 Domain	TA488 ZimReaper	August 2025
analyticemailmeter[.]com	C2 Domain	TA488 ZimReaper	September 2025
emailanalytics.com[.]ua	C2 Domain	TA488 ZimReaper	September 2025
mailnalysis[.]com	C2 Domain	TA488 ZimReaper	November 2025
zimbrastat[.]com	C2 Domain	TA488 ZimReaper	December 2025
zimbrasoft.com[.]ua	C2 Domain	TA488 ZimReaper	January 2026
synacorzimbra[.]nl	C2 Domain	TA488 ZimReaper	February 2026
share-ya[.]space	C2 Domain	TA458 SpyPress	May 2025
xwe[.]us	C2 Domain	TA458 SpyPress	June 2025
hgmydr[.]wiki	C2 Domain	TA458 SpyPress	March 2026
c.laurent.ejfa@proton[.]me	Sender Email	TA488	September 2025
j.moreau.epsc@proton[.]me	Sender Email	TA488	October 2025
zmb_pl_v3_	JS Script ID	ZimReaper Marker	Throughout
ZimbraWeb	App Password Name	Persistence Indicator	Throughout

Section 06

The Escalation — From Human Error to Human Irrelevance

Earlier this year I wrote about how Russian intelligence bypassed Signal without breaking it. They asked people for their verification codes and people handed them over, believing they were talking to support. The human was the vulnerability. The fix — in theory — was training.

Operation RoundPress is the next step. The human is no longer the vulnerability in the same way. You cannot train someone out of opening an email. You cannot build a mental model that protects against an attack that requires no suspicious action. The half-click exploit does not need your trust. It does not need your mistake. It needs your email client to render HTML, which is what email clients are designed to do.

What I find most striking about this campaign is not the technical sophistication — though the @import tag-splitting obfuscation is clever — it is the targeting logic. Russian intelligence did not go after the organizations with the best security tooling. They went after the organizations that made a considered, reasonable decision to self-host their email for sovereignty reasons, and whose IT teams are stretched too thin to maintain the patch cycles that decision requires. The attack is calibrated to the operational reality of the defender, not just the technical vulnerability of the software.

My assumption — and I want to be clear this is analytical hypothesis, not confirmed reporting — is that AI-assisted vulnerability research is accelerating this cycle. Proofpoint itself notes that LLMs will likely increase TA458's vulnerability discovery rate. If that is true, the window between a new webmail CVE and active exploitation is going to compress further. The defenders who cannot patch in 30 days will not be able to patch in 10. The structural gap gets worse, not better.

The NSA and FBI chose to burn this operation publicly. That decision is its own signal — the intelligence community decided the defensive value of disclosure outweighed the counterintelligence value of continued observation. When signals agencies make that call, it means the damage was already significant enough that warning others mattered more than watching longer.

The organizations being targeted are not abstract. They are the people coordinating weapons shipments to Ukraine. The officials managing nuclear facility operations. The defense companies producing the equipment that is physically being used in an active war. The emails stolen from a Ukrainian ministry official's Zimbra inbox over 90 days during active combat are not a data breach in the conventional sense. They are an intelligence collection operation with direct lethal implications.

The email is still the most reliable attack surface. It always was. This campaign is not a new discovery — it is a confirmation that sophisticated actors have been systematically working through every webmail platform with meaningful government adoption, one zero-day at a time, for three years. And the patch gap they are exploiting is not going to close by itself.

This analysis is based entirely on publicly available information including the Proofpoint Threat Insight blog (July 23, 2026), the NSA/FBI Joint Cybersecurity Advisory on TA488/Void Blizzard, ESET's Operation RoundPress report (May 2025), CERT-UA advisories, and US federal court indictment documents. The paragraph on AI-assisted vulnerability research represents analytical hypothesis based on Proofpoint's own forward assessment — it is not confirmed reporting. A companion Sublime Security detection rule targeting the @import tag-splitting obfuscation pattern described in this report has been submitted to the open-source rule feed and is pending review. This analysis represents the author's independent research and is produced as a contribution to the security community.