Sednit abuses XSS flaws to hit gov't entities, defense companies

ESET researchers uncovered "Operation RoundPress", a targeted cyberespionage campaign likely conducted by the Russia-aligned Sednit APT that exploits XSS vulnerabilities — including a zero-day in MDaemon webmail — to steal emails from Ukrainian government accounts and European defense contractors. The attackers targeted multiple webmail platforms (Roundcube, Horde, MDaemon, Zimbra) and sometimes bypassed two-factor authentication to exfiltrate confidential information.