Russia-linked hackers target the email correspondence of military institutions in Eastern Europe

A Russian cyber-espionage group believed to be connected to the Kremlin’s military intelligence agency (GRU) has been conducting a stealth campaign targeting government and military institutions in Eastern Europe, according to new research by Slovak cybersecurity firm ESET.

The operation, dubbed RoundPress, leverages vulnerabilities in popular webmail platforms to spy on email communications, retrieve sensitive data, and ultimately support Russian strategic objectives in the region, particularly regarding the war in Ukraine.

“Most victims are governmental entities and defence companies in Eastern Europe, although we have observed governments in Africa, Europe, and South America being targeted as well”, ESET says in its report.

Precision phishing and zero-click compromises

ESET attributes the campaign to the notorious APT28 (also known as Fancy Bear or Sednit), a threat actor long linked to Russia’s GRU. In its report, the Slovak cyber company details how the group exploited cross-site scripting (XSS) vulnerabilities in several open-source webmail platforms, including Roundcube, Horde, Zimbra, and MDaemon.

“The US Department of Justice named the group as one of those responsible for the Democratic National Committee (DNC) hack just before the 2016 US elections and linked the group to the GRU. The group is also presumed to be behind the hacking of global television network TV5Monde, the World Anti-Doping Agency (WADA) email leak, and many other incidents”, ESET group says in the report.

The group used spear-phishing emails containing embedded JavaScript code that executed automatically when opened. In some cases, the attackers did not even require user interaction beyond viewing the message—making the intrusion especially difficult to detect. According to ESET, a previously unknown vulnerability in MDaemon allowed the attackers to bypass two-factor authentication (2FA), significantly amplifying the threat.

“These attacks demonstrate advanced knowledge of webmail platforms and the ability to discover and weaponize zero-day vulnerabilities,” said ESET malware researcher Matthieu Faou.

Defence sector in the crosshairs

While the precise list of victims remains undisclosed, ESET confirmed that targets included government agencies and defence contractors across Eastern Europe – particularly entities involved in providing Soviet-era military equipment and ammunition to Ukraine.

“Several of the compromised organisations are directly involved in military support to Ukraine,” ESET’s report notes, suggesting the espionage aims to bolster Russian battlefield awareness and disrupt logistical operations.

Although no single country was named, analysts familiar with regional defence dynamics point to Bulgaria and Romania as key hubs for Soviet legacy arms and ammunition, making them likely targets. The campaign also reached institutions in Africa and Latin America, possibly as part of broader Russian geopolitical interests.

Echoes of past Russian cyber operations

The RoundPress campaign fits a broader pattern of Russian cyber aggression across Eastern Europe and the Balkans, where multiple threat actors have targeted pro-Ukrainian states and institutions.

In April 2023, Bulgaria suffered a wave of distributed denial-of-service (DDoS) attacks claimed by the pro-Russian group Killnet. The targets included government websites, financial institutions, and media outlets, prompting Sofia to enhance its national cybersecurity strategy.

Romania experienced a similar wave of attacks in 2022, with Killnet claiming responsibility for disrupting government and transport sector websites. Moldova and Kosovo have also reported incidents involving suspected Russian actors, often following expressions of solidarity with Ukraine.

Ukraine remains the most frequent victim. The Russian group Sandworm, also linked to the GRU, is infamous for the 2015 and 2016 cyberattacks that disrupted parts of Ukraine’s power grid—marking one of the first known instances of a cyberattack causing a physical blackout.

Broader implications for European cyber defence

The new campaign comes at a time of increased cyber vigilance within NATO and the EU, particularly as member states seek to reinforce their cybersecurity postures in the light of ongoing hybrid threats from Moscow.

While the use of phishing and browser-based attacks is not new, the level of sophistication demonstrated in RoundPress, including the use of zero-day exploits and automation of credential theft, marks a concerning evolution in Russian cyber capabilities.

ESET notes that the attackers likely selected webmail platforms specifically because of their widespread use among small-to-medium government organisations, which often lack dedicated cybersecurity teams or the resources for regular patching and monitoring.

Ransomware breach in Bulgaria’s NATO representation?

In a development that may signal a parallel or related incident, Ivaylo Mirchev, an MP from Bulgaria’s liberal pro-European coalition “We Continue the Change – Democratic Bulgaria” (PP-DB), revealed on Thursday that the country’s Permanent Representation to NATO in Brussels suffered a possibly serious cyber breach in April.

Speaking to local media and in parliamentary inquiries, Mirchev stated the attack appeared to be a ransomware attempt and may have involved the leak of sensitive information.

“The Ministry of Defence must clarify whether it was informed of the cyber breach at our NATO Representation, and if so – when, by whom, and through what procedures,” the MP said, calling for official answers. As of publication, Bulgaria’s defence ministry has not responded publicly to the allegations.

The incident raises concerns about the cybersecurity posture of Bulgarian diplomatic and military structures abroad, particularly in the light of increasing Russian cyber activity targeting NATO-linked institutions.

What can be done?

Cybersecurity experts from ESAT recommend a multi-layered defence approach, including routine software updates, stronger authentication protocols, and staff training on phishing awareness.

In the aftermath of the disclosure, developers of the affected webmail platforms have begun issuing patches, but the effectiveness of these fixes depends on how quickly organizations implement them.

“Institutional inertia and lack of resources can leave even patched vulnerabilities open to exploitation,” Faou warned.

As geopolitical tensions continue to manifest in the digital domain, the RoundPress campaign serves as a reminder that cyber warfare is not limited to high-profile attacks on critical infrastructure, but also plays out in the inboxes of civil servants across Europe.

Image: ESET

Updated: May 22, 2025 - 12:03