Half-Click is so Hot Right Now: How Russian and Chinese Attackers Exploit Mailservers

Show notes

Hello to all our cyber stars!

Host Selena Larson is joined by co-host Sarah Sabotka, along with returning guest Greg Lesnewich, Principal Threat Research Engineer, and Staff Threat Researcher Mark Kelly, for a follow-up to last episode's half-click deep dive — this time tracking how the technique is spreading beyond TA458 and TA488 into a brand-new Chinese cluster.

Greg picks up where last week left off with TA488 (aka Void Blizzard, aka Laundry Bear): after going quiet in February following exposure, the group resurfaced on July 22 — one day before Proofpoint's joint advisory with the NSA — with a new half-click exploit against Microsoft Outlook Web Access. The payload, a previously unseen browser-resident implant called OWAReaper, is built for persistence: it survives credential rotation, browser restarts, and even a full device reimage, and it phones home via GitHub commit messages and image requests proxied through legitimate CDNs like Slack and WordPress.

Mark then brings a new actor into the half-click conversation: UNK_MassTraction, a suspected China-aligned cluster exploiting a cross-site scripting flaw in Roundcube to target physics and engineering departments at North American universities — chosen, it turns out, specifically because they were running vulnerable Roundcube instances. The infection chain drops either a webshell or VShell, a Linux backdoor of murky, possibly commercially-developed origin that keeps popping up across Chinese state-sponsored intrusions.

The conversation covers:

How OWAReaper's persistence differs from anything Greg's seen before — including "poisoning" a user's other emails to reinfect the browser on every new tab
Why Greg's assessment of TA488 shifted from "less capable than TA458" to "neck and neck" after seeing this campaign
How Mark and Greg discovered UNK_MassTraction independently, within hours of each other
Why UNK_MassTraction's targets were all running vulnerable Roundcube — evidence of deliberate reconnaissance, not spray-and-pray
IceCube, the Roundcube stealer with telltale signs of LLM-assisted development
Why mail servers are functionally edge devices, and what that means for defenders who can't run EDR on them
Whether AI is accelerating adversary tradecraft on both the Russian and Chinese sides
The ethics of publishing offensive research on a live, evolving technique
The funniest (and most unsettling) lure email of the year: "Hi fellow, I really liked your vibe..."

Plus: Gus the dog's podcast debut, security awareness training in a world where opening an email can be enough, and shoutouts to Tom Lancaster (Volexity) and Microsoft's patch team.

Resources Mentioned:

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit

TA488 Targets Zimbra Mailservers with Half-Click Exploits

One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation

For more information about Proofpoint, check out our website.

Subscribe & Follow:

Stay ahead of emerging threats, and subscribe! Happy hunting!

← Previous

Half-Click, Full Compromise: Inside Russia's TA458 and TA488 Espionage Playbook

Send us fan mail! Hello to all our cyber stars! Host Selena Larson is joined by co-host Sarah Sabotka, along with returning guest Greg Lesnewich, Principal Threat Research Engineer, and Staff Threat Researcher Mark Kelly, for a follow-up to last episode's half-click deep dive — this time tracking how the technique is spreading beyond TA458 and TA488 into a brand-new Chinese cluster. Greg picks up where last week left off with TA488 (aka Void Blizzard, aka Laundry Bear): after going quiet in February following exposure, the group resurfaced on July 22 — one day before Proofpoint's joint advisory with the NSA — with a new half-click exploit against Microsoft Outlook Web Access. The payload, a previously unseen browser-resident implant called OWAReaper, is built for persistence: it survives credential rotation, browser restarts, and even a full device reimage, and it phones home via GitHub commit messages and image requests proxied through legitimate CDNs like Slack and WordPress. Mark then brings a new actor into the half-click conversation: UNK_MassTraction, a suspected China-aligned cluster exploiting a cross-site scripting flaw in Roundcube to target physics and engineering departments at North American universities — chosen, it turns out, specifically because they were running vulnerable Roundcube instances. The infection chain drops either a webshell or VShell, a Linux backdoor of murky, possibly commercially-developed origin that keeps popping up across Chinese state-sponsored intrusions. The conversation covers: How OWAReaper's persistence differs from anything Greg's seen before — including "poisoning" a user's other emails to reinfect the browser on every new tab Why Greg's assessment of TA488 shifted from "less capable than TA458" to "neck and neck" after seeing this campaign How Mark and Greg discovered UNK_MassTraction independently, within hours of each other Why UNK_MassTraction's targets were all running vulnerable Roundcube — evidence of deliberate reconnaissance, not spray-and-pray IceCube, the Roundcube stealer with telltale signs of LLM-assisted development Why mail servers are functionally edge devices, and what that means for defenders who can't run EDR on them Whether AI is accelerating adversary tradecraft on both the Russian and Chinese sides The ethics of publishing offensive research on a live, evolving technique The funniest (and most unsettling) lure email of the year: "Hi fellow, I really liked your vibe..." Plus: Gus the dog's podcast debut, security awareness training in a world where opening an email can be enough, and shoutouts to Tom Lancaster (Volexity) and Microsoft's patch team. Resources Mentioned: Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit TA488 Targets Zimbra Mailservers with Half-Click Exploits One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation For more information about Proofpoint , check out our website . Subscribe & Follow: Stay ahead of emerging threats, and subscribe! Happy hunting!