Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

ESET researchers have uncovered a Russia-aligned espionage operation named RoundPress, targeting high-value webmail servers through XSS vulnerabilities. The campaign, attributed to the Sednit group, aims to steal confidential data from specific email accounts. Initially focused on Roundcube in 2023, the operation expanded to include Horde, MDaemon, and Zimbra in 2024. The attackers exploit various vulnerabilities, including a zero-day in MDaemon, to inject malicious JavaScript code into victims' webmail pages. Targets include governmental entities and defense companies in Eastern Europe, with some victims in Africa, Europe, and South America. The malware, known as SpyPress, can steal webmail credentials, exfiltrate contacts and email messages, and in some cases, bypass two-factor authentication.

Operation RoundPress is a sophisticated espionage campaign attributed to the Russia-aligned threat actor group Sednit, targeting high-value webmail servers primarily used by governmental and defense sector entities. The operation exploits cross-site scripting (XSS) vulnerabilities in popular webmail platforms, including Roundcube, Horde, MDaemon, and Zimbra. Initially observed in 2023 focusing on Roundcube, the campaign expanded in 2024 to target additional webmail software, leveraging multiple vulnerabilities, notably including a zero-day in MDaemon (CVE-2023-23397) and other CVEs such as CVE-2023-43770 and CVE-2024-11182. The attackers inject malicious JavaScript code into the webmail interface, enabling the SpyPress malware to stealthily harvest sensitive information. This includes stealing webmail credentials, exfiltrating contacts and email messages, and in some cases bypassing two-factor authentication mechanisms, significantly increasing the risk of unauthorized access and data compromise. The operation's targeting of governmental and defense organizations in Eastern Europe, with additional victims in Africa, Europe, and South America, indicates a strategic focus on high-value intelligence collection. The exploitation method relies on injecting malicious scripts via XSS vulnerabilities, which do not require initial authentication but do require the victim to access the compromised webmail interface, making user interaction a factor. Despite the medium severity rating assigned, the presence of zero-day exploits and the ability to bypass two-factor authentication elevate the technical sophistication and potential impact of this threat. No known public exploits have been reported yet, but the active targeting and use of zero-days underscore the urgency for affected organizations to implement mitigations promptly.

Detailed information about Operation RoundPress targeting high-value webmail servers. Get real-time updates, technical details, and mitigation strategies.

Operation RoundPress targeting high-value webmail servers - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation RoundPress targeting high-value webmail servers

DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa

The DangerousSavanna campaign is a prolonged cyber espionage and financial crime operation targeting financial institutions primarily in French-speaking African countries, including Cameroon, Ivory Coast, Morocco, Senegal, and Togo. This campaign has been active for at least two years as of the publication date in September 2022. The attackers employ spearphishing techniques, specifically spearphishing with malicious attachments (MITRE ATT&CK T1193 and T1566.001), to gain initial access into targeted organizations. Spearphishing attachments typically involve sending carefully crafted emails containing malicious documents or files that, when opened, execute malware or exploit vulnerabilities to compromise the victim's system. The threat actor behind this campaign, identified as DangerousSavanna, appears to focus on financial institutions, likely aiming to steal sensitive financial data, credentials, or to conduct fraudulent transactions. Although no known exploits are reported in the wild for this campaign, the persistent nature and targeted approach indicate a sophisticated adversary with a medium threat level. The campaign's geographic focus on French-speaking African countries suggests a regional targeting strategy, possibly motivated by financial gain or geopolitical interests. The lack of specific affected software versions or disclosed vulnerabilities implies that the attack vector relies heavily on social engineering and user interaction rather than exploiting software flaws. The campaign's medium severity rating reflects the moderate but significant risk posed by successful spearphishing attacks, which can lead to data breaches, financial loss, and reputational damage.

Detailed information about DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa. Get real-time updates, technical d

DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Affecting Cameroon

Filter Threats

Threats Affecting Cameroon

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility