ta458 roundpress exploits

By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team

July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team

This is part 2 of a 2-part blog series Proofpoint is publishing about Russian espionage actors using half-click exploits to target government webmail servers. Read part 1 about TA488 here, and the accompanying advisory from NSA here. Threat Research would like to thank the Proofpoint Cloudmark Authority team.

Key Findings

The Russia-aligned threat actor TA458, the group beh…