FancyBear Exposed: A Major OPSEC Blunder Reveals Russian Espionage Operations Against Ukraine

Published March 18, 2026 | RedSheep Reports

Russia's APT28, commonly known as FancyBear, left the front door to its espionage infrastructure wide open. An exposed open directory on a NameCheap VPS at 203.161.50.145, first captured on January 13, 2026, gave researchers a full view into the group's operational toolkit, exfiltrated data, and victim telemetry [1][2]. The server contained over 2,800 stolen emails, more than 240 sets of harvested credentials (including TOTP two-factor authentication secrets), and the complete source code for a Roundcube webmail exploitation framework dubbed Operation Roundish [1]. This wasn't a brief window of exposure. According to Censys telemetry, the directory on port 8889 was detected as open between January 31, 2026 at 12:14 UTC and March 11, 2026 at 10:02 UTC [1].

The truly remarkable part is that Ukrainian CERT publicly attributed this exact server to APT28 back on October 25, 2024 [1]. FancyBear kept using it anyway, operating from the same infrastructure for more than 500 days after public attribution [1]. This demonstrates operational complacency rather than persistence.

APT28: GRU's Cyber Arm

APT28, also tracked as Sednit, Sofacy, and FancyBear, is affiliated with Unit 26165 of Russia's Main Intelligence Directorate (GRU) [5]. The group has been active since at least 2004, and the U.S. Department of Justice linked the group to the GRU in connection with the Democratic National Committee hack [3]. Their target list reads like a strategic priority map for Moscow: governmental entities, defense companies, military organizations, and energy and transportation sectors across the United States, Europe, and the Middle East [7].

Since Russia's full-scale invasion of Ukraine, APT28 has heavily focused on Ukrainian government and military targets [4]. Their operational tempo has been aggressive, with multiple concurrent campaigns using both custom malware and exploitation of widely deployed webmail platforms. The group's toolkit has expanded considerably: alongside the Roundcube exploitation covered here, APT28 has deployed BEARDSHELL, COVENANT, and SLIMAGENT malware against Ukrainian military personnel since April 2024 [5].

Operation Roundish: Inside the Toolkit

Hunt.io's analysis of the exposed directory revealed 61 files spread across 36 subdirectories, totaling 52 MB [1]. The server hosted seven distinct services, including a Roundcube instance on port 443 [1]. Hunt.io assessed with "medium-high confidence" that the activity aligns with APT28 [1], a judgment supported by 14 TTP overlaps with ESET's previously documented Operation RoundPress campaign [1].

Operation RoundPress, first uncovered by ESET, targets webmail platforms through spearphishing emails that exploit cross-site scripting (XSS) vulnerabilities [4]. The campaign began in 2023 targeting only Roundcube, then expanded in 2024 to include Horde, MDaemon, and Zimbra [4][7]. Victims are overwhelmingly tied to the war in Ukraine: governmental entities, defense companies, and notably manufacturers of Soviet-era weapons destined for Ukrainian forces [4].

Attack Chain: From Spearphish to Silent Exfiltration

The attack chain is methodical and built for stealth.

Initial Access starts with spearphishing emails that exploit XSS vulnerabilities in webmail platforms [4]. The primary Roundcube vulnerability is CVE-2023-43770, a persistent XSS issue that CISA added to its Known Exploited Vulnerabilities catalog [6]. Patched on September 15, 2023, the vulnerability remains effective against unpatched Roundcube installations [6]. APT28 also discovered and exploited CVE-2024-11182, a zero-day in MDaemon webmail [3][7].

Payload Execution requires no file downloads or clicks beyond opening the malicious email in a vulnerable webmail portal [7]. The exposed toolkit contained multiple JavaScript payloads: worker.js, newworker.js, workerlast.js, scriptTaker.js, old_worker.js, and a previously undisclosed SquirrelMail variant called worker2.js [1]. An address book extraction module, adbook.js, gets loaded by the worker variants [1]. The server-side component serverlast.py functions as a Flask-based C2 server, while roundcube-css-exploit.js handles CSS injection [1].

Credential Harvesting is comprehensive. The SpyPress family of payloads captures webmail login credentials, login history, and two-factor authentication codes [4][7]. SpyPress.MDAEMON is particularly dangerous: it can bypass 2FA entirely by exfiltrating the underlying TOTP secrets, not just individual codes [7]. The exposed directory confirmed this capability at scale, with 240+ credential sets including passwords and TOTP secrets [1].

Persistent Access comes through Sieve mail forwarding rules. SpyPress.ROUNDCUBE creates rules that silently copy every incoming email to an attacker-controlled address [7]. The exposed infrastructure contained 140+ such forwarding rules, meaning victims' email continued flowing to APT28 long after the initial compromise [1].

Bulk Exfiltration rounded out the operation. The directory held 2,800+ exfiltrated emails [1], including a 42 MB scanned document with a filename suggesting it was captured from a Konica Minolta bizhub multifunction printer [1].

The C2 Domain Infrastructure

The primary C2 domain was zhblz.com, registered on July 10, 2024 [1]. APT28 used subdomains for specific functions: a.zhblz.com for CSS injection, and elaborate Google Docs typosquatting subdomains like docs.goog1e.com.spreadsheets.d.1ipevana4hglaeksstshboujdk.zhblz.com for phishing operations [1]. The sophistication of the subdomain structure contrasts sharply with the carelessness that left the entire toolkit exposed.

Broader SpyPress infrastructure spans multiple C2 domains: ceriossl.info, global-world-news.net, sqj.fr, tgh24.xyztuo.world, jiaw.shop, hijx.xyz, and ikses.net [4][7]. These are hosted across diverse IP ranges, suggesting deliberate geographic distribution of C2 nodes.

The Parallel Malware Arsenal

While Operation Roundish focused on webmail exploitation, APT28 simultaneously ran a separate implant-based campaign against Ukrainian military personnel [5]. This operation uses BEARDSHELL, a sophisticated implant deployed via a loader DLL called PlaySndSrv.dll that executes PowerShell commands [5]. Alongside it, COVENANT (a heavily modified open-source .NET post-exploitation framework) provides persistent access [5]. SLIMAGENT handles keylogging, screenshot capture, and clipboard data collection [5].

The COVENANT implant's C2 channel has migrated across cloud storage providers: pCloud in 2023, Koofr from 2024 to 2025, and Filen since July 2025 [5]. This dual-implant strategy enables long-term surveillance even when webmail access is eventually remediated.

IOC Table

MITRE ATT&CK Mapping

Detection and Hunting

Email Infrastructure Monitoring: The most immediately actionable detection vector is hunting for unauthorized Sieve forwarding rules. Query your mail server logs for new Sieve rules created during user sessions that originated from abnormal source IPs. Any Sieve rule forwarding to an external address that the user didn't explicitly configure warrants immediate investigation.

Network IOC Matching: Block and alert on all listed C2 IPs and domains. Pay particular attention to DNS queries containing zhblz.com and its subdomains, especially the long Google Docs typosquatting strings. A SIEM query like dns.query:zhblz.com OR dns.query:goog1e.com* (note the numeral "1") will catch the phishing infrastructure.

Webmail XSS Detection: Monitor Roundcube, Horde, MDaemon, Zimbra, and SquirrelMail server logs for unusual JavaScript execution patterns. Look for HTTP requests fetching the known payload filenames: worker.js, newworker.js, workerlast.js, scriptTaker.js, adbook.js, and worker2.js from external origins.

Vulnerability Assessment: CVE-2023-43770 (Roundcube) was patched in September 2023, and CVE-2024-11182 (MDaemon) has also been patched [6][3]. Organizations still running vulnerable versions are exposed to this exact toolkit. Scan for unpatched webmail instances immediately.

Cloud Storage C2 Detection: COVENANT's use of Filen (and previously pCloud and Koofr) for C2 means defenders should monitor for unusual outbound traffic to these legitimate cloud storage services from systems that shouldn't be using them [5]. Look for PlaySndSrv.dll on endpoints as a BEARDSHELL indicator [5].

Analysis

This exposure provides an unusually complete picture of a state-sponsored espionage operation in progress. The more than 500 days of continued use after public attribution [1] speaks to a calculated risk assessment by APT28's operators: the infrastructure was productive enough, and the targets important enough, that they chose operational continuity over security. Ukrainian CERT's October 2024 attribution didn't trigger a teardown. That tells us something about GRU's cost-benefit calculus regarding burned infrastructure.

The toolkit itself reveals a group optimizing for scale. Sieve forwarding rules provide persistent, passive collection that doesn't require repeated access [7]. The 140+ rules found on the server mean APT28 had a continuous stream of intelligence flowing from over a hundred compromised mailboxes without lifting a finger [1]. The 2FA bypass capability in SpyPress.MDAEMON [7] is particularly concerning for organizations that rely on TOTP-based MFA as a primary defense for webmail.

The expansion from Roundcube to four webmail platforms [4] and the addition of a SquirrelMail variant (worker2.js) found in this exposure [1] show APT28 systematically broadening its attack surface. Any organization running self-hosted webmail is a potential target.

References

1. Ctrl-Alt-Intel, "FancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage Ops" - https://ctrlaltintel.com/threat%20research/FancyBear/
2. Hunt.io, "Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine" - https://hunt.io/blog/operation-roundish-apt28-roundcube-exploitation
3. ESET, "ESET Research uncovers Operation RoundPress" - https://www.eset.com/us/about/newsroom/research/eset-research-uncovers-operation-roundpress-russia-aligned-sednit-targets-entities-linked-to-the-ukraine-war-to-steal-confidential-data/
4. WeLiveSecurity, "Operation RoundPress targeting high-value webmail servers" - https://www.welivesecurity.com/en/eset-research/operation-roundpress/
5. The Hacker News, "APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military" - https://thehackernews.com/2026/03/apt28-uses-beardshell-and-covenant.html
6. SecurityWeek, "CISA Warns of Roundcube Webmail Vulnerability Exploitation" - https://www.securityweek.com/cisa-warns-of-roundcube-webmail-vulnerability-exploitation/
7. The Hacker News, "Russia-Linked APT28 Exploited MDaemon Zero-Day to Hack Government Webmail Servers" - https://thehackernews.com/2025/05/russia-linked-apt28-exploited-mdaemon.html
8. Hendry Adrian, "Operation RoundPress" - https://www.hendryadrian.com/operation-roundpress/