TLDR Tech / InfoSec
FancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage Ops
An operational security (OPSEC) failure on a NameCheap VPS inadvertently exposed FancyBear/APT28's active Command and Control (C2) infrastructure. This blunder revealed a modular webmail exploitation toolkit designed to target Roundcube and SquirrelMail via Cross-Site Scripting (XSS). The toolkit silently exfiltrated over 2,800 emails, stole more than 240 credential sets, including TOTP secrets, and deployed over 140 persistent Sieve forwarding rules to redirect all incoming mail to advenwolf@proton[.]me. These actions were triggered without victim interaction beyond opening a spearphishing email. The exposed open directory on port 8889 contained server-side C2 source code, comprehensive telemetry logs, and lure PDFs targeting Ukrainian prosecutors, the Romanian Air Force, the Greek GEETHA, and the Serbian Ministry of Defense across six countries. Defenders should audit Roundcube and SquirrelMail instances for unauthorized Sieve rules, block zhblz[.]com and 203.161.50[.]145, rotate credentials and TOTP secrets for affected organizations, and disable ManageSieve where not operationally required.
Read the full story