SpyPressMalware
According to ESET, SpyPress is a set of Javascript payloads targeting different webmail frameworks (HORDE, MDAEMON, ROUNDCUBE, ZIMBRA). The observed payloads have common characteristics. All are similarly obfuscated, with variable and function names replaced with random-looking strings.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1056.001Keylogging
“The toolkit was unchanged: X-Agent for keylogging and screenshotting, X-Tunnel for exfiltration, Mimikatz for credential theft.”
- T1059.009Cloud API
“On the highest-priority targets, APT28 escalates to BeardShell, a custom C++ backdoor that uses the icedrive cloud API for C2.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
APT28: An Evolution of Tradecraft from X-Agent to LLM Malware“Weaponized XSS flaws in widely-deployed webmail platforms to inject SpyPress and silently exfiltrate inboxes, contacts, and credentials from Ukrainian government and Eastern European defense suppliers.”
Thanks — we review every report.