Field Effect Blog Russian APT28 hackers leverage webmail zero-day

Hackers belonging to Russia's Main Intelligence Directorate (GRU), known as APT28, Fancy Bear and Sednit, have been implicated in a series of attacks targeting webmail servers through cross-site scripting (XSS) vulnerabilities. Dubbed "Operation RoundPress", the campaign began in 2023 and primarily aims to extract sensitive information from specific email accounts.